[
https://issues.apache.org/jira/browse/HADOOP-10398?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13941993#comment-13941993
]
Robert Kanter commented on HADOOP-10398:
----------------------------------------
{quote} In production, we generally don't want to use the token cache since
multiple different users on the same machine can mess up the token.{quote}
By default, the token ends up in the user's home dir; so multiple users
shouldn't be a problem. (Unless they all have the same home directory, but
that doesn't seem right).
For 2, IIRC, the {{oozie.service.AuthorizationService.security.enabled}} stuff
is handled soley within Oozie, isn't it? It isn't related to tokens at all. A
quick look at AuthorizationService it looks like it just checks the username of
a job against the current user or the admin list.
[~bowenzhangusa], have you run into this problem when you don't set the cache
to false?
> KerberosAuthenticator failed to fall back to PseudoAuthenticator after
> HADOOP-10078
> -----------------------------------------------------------------------------------
>
> Key: HADOOP-10398
> URL: https://issues.apache.org/jira/browse/HADOOP-10398
> Project: Hadoop Common
> Issue Type: Bug
> Components: security
> Reporter: Tsz Wo Nicholas Sze
> Assignee: Tsz Wo Nicholas Sze
> Attachments: a.txt, c10398_20140310.patch
>
>
> {code}
> //KerberosAuthenticator.java
> if (conn.getResponseCode() == HttpURLConnection.HTTP_OK) {
> LOG.debug("JDK performed authentication on our behalf.");
> // If the JDK already did the SPNEGO back-and-forth for
> // us, just pull out the token.
> AuthenticatedURL.extractToken(conn, token);
> return;
> } else ...
> {code}
> The problem of the code above is that HTTP_OK does not implies authentication
> completed. We should check if the token can be extracted successfully.
> This problem was reported by [~bowenzhangusa] in [this
> comment|https://issues.apache.org/jira/browse/HADOOP-10078?focusedCommentId=13896823&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-13896823]
> earlier.
--
This message was sent by Atlassian JIRA
(v6.2#6252)
