[
https://issues.apache.org/jira/browse/FALCON-1282?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Venkat Ranganathan updated FALCON-1282:
---------------------------------------
Description:
While uploading the patch for FALCON-1129, I missed one of the changes which
was to set the property mapreduce.job.hdfs-servers to be actually processed as
part of the Oozie Launcher Job so that delegation tokens can be acquired by the
Jobclient launched by the Oozie server.
Sorry about that. Realized as part of our security tests which failed with
the fix and realized we missed the prefix. When we tested last, it looks like
there was a leak of Kerberos credentials as the test user (some setup had done
kinit as the user), which meant we actually did a spnego authentication from
the mapper node :(
I have not set the FixVersion of this bug given that 0.6.1 is going through
RCs. This is a one line change to the patch in FALCON-1129. If you think
this can be included in 0.6.1 please do so
was:
While uploading the patch for 1129, I missed one of the changes which was to
set the property mapreduce.job.hdfs-servers to be actually processed as part of
the Oozie Launcher Job so that delegation tokens can be acquired by the
Jobclient launched by the Oozie server.
Sorry about that. Realized as part of our security tests which failed with
the fix and realized we missed the prefix. When we tested last, it looks like
there was a leak of Kerberos credentials as the test user (some setup had done
kinit as the user), which meant we actually did a spnego authentication from
the mapper node :(
I have not set the FixVersion of this bug given that 0.6.1 is going through
RCs. This is a one line change to the patch in FALCON-1129. If you think
this can be included in 0.6.1 please do so
> FALCON-1129 sets the wrong property in oozie workflow
> -----------------------------------------------------
>
> Key: FALCON-1282
> URL: https://issues.apache.org/jira/browse/FALCON-1282
> Project: Falcon
> Issue Type: Bug
> Affects Versions: 0.6.1
> Environment: Secure clusters
> Reporter: Venkat Ranganathan
> Assignee: Venkat Ranganathan
> Priority: Critical
>
> While uploading the patch for FALCON-1129, I missed one of the changes which
> was to set the property mapreduce.job.hdfs-servers to be actually processed
> as part of the Oozie Launcher Job so that delegation tokens can be acquired
> by the Jobclient launched by the Oozie server.
> Sorry about that. Realized as part of our security tests which failed with
> the fix and realized we missed the prefix. When we tested last, it looks
> like there was a leak of Kerberos credentials as the test user (some setup
> had done kinit as the user), which meant we actually did a spnego
> authentication from the mapper node :(
> I have not set the FixVersion of this bug given that 0.6.1 is going through
> RCs. This is a one line change to the patch in FALCON-1129. If you think
> this can be included in 0.6.1 please do so
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
