Xiao Chen commented on HDFS-10757:

Thanks [~xyao] for the new patch. I see 
{{UserGroupInformation.AuthenticationMethod.TOKEN}} in the condition, is the 
concern by [~jnp]'s comment above dropped?
Also was this tested in clusters? For cases like HADOOP-12787 we don't have 
test coverage.

> KMSClientProvider combined with KeyProviderCache can result in wrong UGI 
> being used
> -----------------------------------------------------------------------------------
>                 Key: HDFS-10757
>                 URL: https://issues.apache.org/jira/browse/HDFS-10757
>             Project: Hadoop HDFS
>          Issue Type: Bug
>            Reporter: Sergey Shelukhin
>            Assignee: Xiaoyu Yao
>            Priority: Critical
>         Attachments: HDFS-10757.00.patch, HDFS-10757.01.patch, 
> HDFS-10757.02.patch
> ClientContext::get gets the context from CACHE via a config setting based 
> name, then KeyProviderCache stored in ClientContext gets the key provider 
> cached by URI from the configuration, too. These would return the same 
> KeyProvider regardless of current UGI.
> KMSClientProvider caches the UGI (actualUgi) in ctor; that means in 
> particular that all the users of DFS with KMSClientProvider in a process will 
> get the KMS token (along with other credentials) of the first user, via the 
> above cache.
> Either KMSClientProvider shouldn't store the UGI, or one of the caches should 
> be UGI-aware, like the FS object cache.
> Side note: the comment in createConnection that purports to handle the 
> different UGI doesn't seem to cover what it says it covers. In our case, we 
> have two unrelated UGIs with no auth (createRemoteUser) with bunch of tokens, 
> including a KMS token, added.

This message was sent by Atlassian JIRA

To unsubscribe, e-mail: hdfs-issues-unsubscr...@hadoop.apache.org
For additional commands, e-mail: hdfs-issues-h...@hadoop.apache.org

Reply via email to