[ 
https://issues.apache.org/jira/browse/HDFS-17128?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17748733#comment-17748733
 ] 

ASF GitHub Bot commented on HDFS-17128:
---------------------------------------

simbadzina commented on code in PR #5897:
URL: https://github.com/apache/hadoop/pull/5897#discussion_r1278071362


##########
hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/SQLDelegationTokenSecretManager.java:
##########
@@ -46,6 +50,9 @@ public abstract class 
SQLDelegationTokenSecretManager<TokenIdent
   private static final String SQL_DTSM_TOKEN_SEQNUM_BATCH_SIZE = 
SQL_DTSM_CONF_PREFIX
       + "token.seqnum.batch.size";
   public static final int DEFAULT_SEQ_NUM_BATCH_SIZE = 10;
+  public static final String SQL_DTSM_TOKEN_LOADING_CACHE_EXPIRATION_MS = 
SQL_DTSM_CONF_PREFIX
+      + "token.loading.cache.expiration.ms";
+  public static final int SQL_DTSM_TOKEN_LOADING_CACHE_EXPIRATION_DEFAULT_MS = 
10000;

Review Comment:
   Makes sense. I hadn't thought about stale tokens.
   Do you know how early renewal is done? If it is a say half-way into the 
token's 24 hour lifetime, then there would be more time to refresh the cache.
   
   Anyhow, since this is a configurable value operators can explore what value 
is appropriate for them.





> RBF: SQLDelegationTokenSecretManager should use version of tokens updated by 
> other routers
> ------------------------------------------------------------------------------------------
>
>                 Key: HDFS-17128
>                 URL: https://issues.apache.org/jira/browse/HDFS-17128
>             Project: Hadoop HDFS
>          Issue Type: Improvement
>          Components: rbf
>            Reporter: Hector Sandoval Chaverri
>            Priority: Major
>              Labels: pull-request-available
>
> The SQLDelegationTokenSecretManager keeps tokens that it has interacted with 
> in a memory cache. This prevents routers from connecting to the SQL server 
> for each token operation, improving performance.
> We've noticed issues with some tokens being loaded in one router's cache and 
> later renewed on a different one. If clients try to use the token in the 
> outdated router, it will throw an "Auth failed" error when the cached token's 
> expiration has passed.
> This can also affect cancelation scenarios since a token can be removed from 
> one router's cache and still exist in another one.
> A possible solution is already implemented on the 
> ZKDelegationTokenSecretManager, which consists of having an executor 
> refreshing each router's cache on a periodic basis. We should evaluate 
> whether this will work with the volume of tokens expected to be handled by 
> the SQLDelegationTokenSecretManager.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: hdfs-issues-unsubscr...@hadoop.apache.org
For additional commands, e-mail: hdfs-issues-h...@hadoop.apache.org

Reply via email to