Siyao Meng created HDDS-17289:
---------------------------------
Summary: OM renew delegation token apply can still write a
canceled token back on an OM that restarted after the cancel
Key: HDDS-17289
URL: https://issues.apache.org/jira/browse/HDDS-17289
Project: Apache Ozone
Issue Type: Bug
Components: Security, OM HA
Reporter: Siyao Meng
HDDS-17177 makes the OM renew delegation token apply reject a token whose
cancel was already applied. The record of applied cancels
({{OzoneDelegationTokenSecretManager.canceledTokens}}) is kept in memory only,
so it is lost when an OM restarts or installs a checkpoint.
h3. Problem
# A renew is validated on the leader while token T is valid, but is applied
later.
# All OMs apply the cancel of T, which deletes its {{dTokenTable}} row.
# OM B restarts, or installs a checkpoint, after the cancel is flushed. Its in
memory record of the cancel is gone.
# All OMs apply the late renew. OMs that did not restart reject it. OM B
accepts it and writes T back, so T authenticates again on B.
After a restart, a missing row does not tell B whether T was canceled or
removed by {{ExpiredTokenRemover}}. The renew apply must still accept a renew
after the remover deleted the row, since the remover runs outside Ratis on each
OM's own clock (HDDS-13457).
h3. Proposal
Persist the cancel, for example as a marker row in {{dTokenTable}} instead of
deleting the row, and have the renew apply check the marker. To be addressed:
* An OM layout feature: an OM without this change treats the marker as an
expired token, and its remover deletes it or its renew apply overwrites it.
* Removing markers after the token's max date, when no renew can succeed.
* Startup token loading and {{ExpiredTokenRemover}} skipping markers.
* Ordering between a cancel and a concurrent expiry deletion by the remover.
A reference implementation from the HDDS-17177 review:
https://github.com/jojochuang/ozone/commit/fd46c517b847e7893dc4b02d16116850d1bb8d62
(it does not include the layout feature or marker removal yet). Review
discussion:
https://github.com/apache/ozone/pull/11642#pullrequestreview-5592347674
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
