Author: jlowe
Date: Thu May 8 21:22:26 2014
New Revision: 1593422
URL: http://svn.apache.org/r1593422
Log:
MAPREDUCE-5884. History server uses short user name when canceling tokens.
Contributed by Mohammad Kamrul Islam
Modified:
hadoop/common/trunk/hadoop-mapreduce-project/CHANGES.txt
hadoop/common/trunk/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-hs/src/main/java/org/apache/hadoop/mapreduce/v2/hs/HistoryClientService.java
hadoop/common/trunk/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-hs/src/test/java/org/apache/hadoop/mapreduce/v2/hs/TestJHSDelegationTokenSecretManager.java
hadoop/common/trunk/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-jobclient/src/test/java/org/apache/hadoop/mapreduce/security/TestJHSSecurity.java
Modified: hadoop/common/trunk/hadoop-mapreduce-project/CHANGES.txt
URL:
http://svn.apache.org/viewvc/hadoop/common/trunk/hadoop-mapreduce-project/CHANGES.txt?rev=1593422&r1=1593421&r2=1593422&view=diff
==============================================================================
--- hadoop/common/trunk/hadoop-mapreduce-project/CHANGES.txt (original)
+++ hadoop/common/trunk/hadoop-mapreduce-project/CHANGES.txt Thu May 8
21:22:26 2014
@@ -213,6 +213,9 @@ Release 2.5.0 - UNRELEASED
MAPREDUCE-5749. TestRMContainerAllocator#testReportedAppProgress Failed
(jlowe)
+ MAPREDUCE-5884. History server uses short user name when canceling tokens
+ (Mohammad Kamrul Islam via jlowe)
+
Release 2.4.1 - UNRELEASED
INCOMPATIBLE CHANGES
Modified:
hadoop/common/trunk/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-hs/src/main/java/org/apache/hadoop/mapreduce/v2/hs/HistoryClientService.java
URL:
http://svn.apache.org/viewvc/hadoop/common/trunk/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-hs/src/main/java/org/apache/hadoop/mapreduce/v2/hs/HistoryClientService.java?rev=1593422&r1=1593421&r2=1593422&view=diff
==============================================================================
---
hadoop/common/trunk/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-hs/src/main/java/org/apache/hadoop/mapreduce/v2/hs/HistoryClientService.java
(original)
+++
hadoop/common/trunk/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-hs/src/main/java/org/apache/hadoop/mapreduce/v2/hs/HistoryClientService.java
Thu May 8 21:22:26 2014
@@ -396,7 +396,7 @@ public class HistoryClientService extend
.array(), new Text(protoToken.getKind()), new Text(
protoToken.getService()));
- String user = UserGroupInformation.getCurrentUser().getShortUserName();
+ String user = UserGroupInformation.getCurrentUser().getUserName();
jhsDTSecretManager.cancelToken(token, user);
return Records.newRecord(CancelDelegationTokenResponse.class);
}
Modified:
hadoop/common/trunk/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-hs/src/test/java/org/apache/hadoop/mapreduce/v2/hs/TestJHSDelegationTokenSecretManager.java
URL:
http://svn.apache.org/viewvc/hadoop/common/trunk/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-hs/src/test/java/org/apache/hadoop/mapreduce/v2/hs/TestJHSDelegationTokenSecretManager.java?rev=1593422&r1=1593421&r2=1593422&view=diff
==============================================================================
---
hadoop/common/trunk/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-hs/src/test/java/org/apache/hadoop/mapreduce/v2/hs/TestJHSDelegationTokenSecretManager.java
(original)
+++
hadoop/common/trunk/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-hs/src/test/java/org/apache/hadoop/mapreduce/v2/hs/TestJHSDelegationTokenSecretManager.java
Thu May 8 21:22:26 2014
@@ -30,6 +30,8 @@ import java.util.Map;
import org.apache.hadoop.conf.Configuration;
import org.apache.hadoop.io.Text;
import org.apache.hadoop.mapreduce.v2.api.MRDelegationTokenIdentifier;
+import org.apache.hadoop.security.AccessControlException;
+import org.apache.hadoop.security.authentication.util.KerberosName;
import org.apache.hadoop.security.token.Token;
import org.apache.hadoop.security.token.delegation.DelegationKey;
import org.junit.Test;
@@ -87,6 +89,24 @@ public class TestJHSDelegationTokenSecre
assertEquals("sequence number restore", tokenId2.getSequenceNumber() + 1,
tokenId3.getSequenceNumber());
mgr.cancelToken(token1, "tokenOwner");
+
+ // Testing with full principal name
+ MRDelegationTokenIdentifier tokenIdFull = new MRDelegationTokenIdentifier(
+ new Text("tokenOwner/localhost@LOCALHOST"), new Text("tokenRenewer"),
+ new Text("tokenUser"));
+ KerberosName.setRules("RULE:[1:$1]\nRULE:[2:$1]");
+ Token<MRDelegationTokenIdentifier> tokenFull = new
Token<MRDelegationTokenIdentifier>(
+ tokenIdFull, mgr);
+ // Negative test
+ try {
+ mgr.cancelToken(tokenFull, "tokenOwner");
+ } catch (AccessControlException ace) {
+ assertTrue(ace.getMessage().contains(
+ "is not authorized to cancel the token"));
+ }
+ // Succeed to cancel with full principal
+ mgr.cancelToken(tokenFull, tokenIdFull.getOwner().toString());
+
long tokenRenewDate3 = mgr.getAllTokens().get(tokenId3).getRenewDate();
mgr.stopThreads();
Modified:
hadoop/common/trunk/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-jobclient/src/test/java/org/apache/hadoop/mapreduce/security/TestJHSSecurity.java
URL:
http://svn.apache.org/viewvc/hadoop/common/trunk/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-jobclient/src/test/java/org/apache/hadoop/mapreduce/security/TestJHSSecurity.java?rev=1593422&r1=1593421&r2=1593422&view=diff
==============================================================================
---
hadoop/common/trunk/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-jobclient/src/test/java/org/apache/hadoop/mapreduce/security/TestJHSSecurity.java
(original)
+++
hadoop/common/trunk/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-jobclient/src/test/java/org/apache/hadoop/mapreduce/security/TestJHSSecurity.java
Thu May 8 21:22:26 2014
@@ -198,6 +198,11 @@ public class TestJHSSecurity {
fail("Unexpected exception" + e);
}
cancelDelegationToken(loggedInUser, hsService, token);
+
+ // Testing the token with different renewer to cancel the token
+ Token tokenWithDifferentRenewer = getDelegationToken(loggedInUser,
+ hsService, "yarn");
+ cancelDelegationToken(loggedInUser, hsService,
tokenWithDifferentRenewer);
if (clientUsingDT != null) {
// RPC.stopProxy(clientUsingDT);
clientUsingDT = null;
