[
https://issues.apache.org/jira/browse/HADOOP-12587?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15013691#comment-15013691
]
Steve Loughran commented on HADOOP-12587:
-----------------------------------------
Stack trace with the initial patch applied.
{code}
java.io.IOException:
org.apache.hadoop.security.authentication.client.AuthenticationException:
Incomplete token string -present: p= stevel@COTHAM; t= kerberos-dt; u= stevel;
e= 1447944593313; Missing attributes: [ i ]
at
org.apache.hadoop.yarn.client.api.impl.TimelineClientImpl$5.run(TimelineClientImpl.java:453)
at
org.apache.hadoop.yarn.client.api.impl.TimelineClientImpl$TimelineClientConnectionRetry.retryOn(TimelineClientImpl.java:183)
at
org.apache.hadoop.yarn.client.api.impl.TimelineClientImpl.operateDelegationToken(TimelineClientImpl.java:466)
at
org.apache.hadoop.yarn.client.api.impl.TimelineClientImpl.getDelegationToken(TimelineClientImpl.java:363)
at
org.apache.hadoop.yarn.client.api.impl.YarnClientImpl.getTimelineDelegationToken(YarnClientImpl.java:354)
at
org.apache.hadoop.yarn.client.api.impl.YarnClientImpl.addTimelineDelegationToken(YarnClientImpl.java:335)
at
org.apache.hadoop.yarn.client.api.impl.YarnClientImpl.submitApplication(YarnClientImpl.java:255)
at
org.apache.slider.core.launch.AppMasterLauncher.submitApplication(AppMasterLauncher.java:259)
at
org.apache.slider.client.SliderClient.launchApplication(SliderClient.java:2164)
at
org.apache.slider.client.SliderClient.startCluster(SliderClient.java:1773)
at
org.apache.slider.client.SliderClient.actionCreate(SliderClient.java:703)
at org.apache.slider.client.SliderClient.exec(SliderClient.java:356)
at
org.apache.slider.client.SliderClient.runService(SliderClient.java:318)
at
org.apache.slider.core.main.ServiceLauncher.launchService(ServiceLauncher.java:188)
at
org.apache.slider.core.main.ServiceLauncher.launchServiceRobustly(ServiceLauncher.java:475)
at
org.apache.slider.core.main.ServiceLauncher.launchServiceAndExit(ServiceLauncher.java:403)
at
org.apache.slider.core.main.ServiceLauncher.serviceMain(ServiceLauncher.java:630)
at org.apache.slider.Slider.main(Slider.java:49)
Caused by:
org.apache.hadoop.security.authentication.client.AuthenticationException:
Incomplete token string -present: p= stevel@COTHAM; t= kerberos-dt; u= stevel;
e= 1447944593313; Missing attributes: [ i ]
at
org.apache.hadoop.security.authentication.util.AuthToken.parse(AuthToken.java:223)
at
org.apache.hadoop.security.authentication.client.KerberosAuthenticator.isTokenKerberos(KerberosAuthenticator.java:240)
at
org.apache.hadoop.security.authentication.client.KerberosAuthenticator.authenticate(KerberosAuthenticator.java:198)
at
org.apache.hadoop.security.token.delegation.web.DelegationTokenAuthenticator.authenticate(DelegationTokenAuthenticator.java:128)
at
org.apache.hadoop.security.authentication.client.AuthenticatedURL.openConnection(AuthenticatedURL.java:215)
at
org.apache.hadoop.security.token.delegation.web.DelegationTokenAuthenticator.doDelegationTokenOperation(DelegationTokenAuthenticator.java:285)
at
org.apache.hadoop.security.token.delegation.web.DelegationTokenAuthenticator.getDelegationToken(DelegationTokenAuthenticator.java:166)
at
org.apache.hadoop.security.token.delegation.web.DelegationTokenAuthenticatedURL.getDelegationToken(DelegationTokenAuthenticatedURL.java:371)
at
org.apache.hadoop.yarn.client.api.impl.TimelineClientImpl$2.run(TimelineClientImpl.java:359)
at
org.apache.hadoop.yarn.client.api.impl.TimelineClientImpl$2.run(TimelineClientImpl.java:351)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAs(Subject.java:422)
at
org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1657)
at
org.apache.hadoop.yarn.client.api.impl.TimelineClientImpl$5.run(TimelineClientImpl.java:451)
... 17 more
{code}
> Hadoop AuthToken refuses to work without a maxinactive attribute in issued
> token
> --------------------------------------------------------------------------------
>
> Key: HADOOP-12587
> URL: https://issues.apache.org/jira/browse/HADOOP-12587
> Project: Hadoop Common
> Issue Type: Bug
> Components: security
> Affects Versions: 2.7.1
> Environment: OSX heimdal kerberos client against Linux KDC -talking
> to a Hadoop 2.6.0 cluster
> Reporter: Steve Loughran
> Assignee: Steve Loughran
> Priority: Blocker
>
> If you don't have a max-inactive attribute in the auth token returned from
> the web site, AuthToken will raise an exception. This stops callers without
> this token being able to submit jobs to a secure Hadoop 2.6 YARN cluster with
> timeline server enabled.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
