[
https://issues.apache.org/jira/browse/MAPREDUCE-3727?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13193382#comment-13193382
]
Vinod Kumar Vavilapalli commented on MAPREDUCE-3727:
----------------------------------------------------
This happens on trunk also. Clearly there is a TODO in the code which says the
current place is inappropriate for reading the tokens file.
If this code gets triggered, it is not just the reading of token file that will
fail. Whenever this happens (don't know by what trigger), the client will try
to obtain delegation tokens from the NameNode which will also fail? Have any
clue why that isn't happening?
bq. One possible solution would be the JobClient to remove this property before
submitting the job.
I guess you mean as part of the individual Oozie actions. Right?
The alternative could be to not fail with exception when it cannot read the
file, but instead just log an error and continue. Not sure whether that's a
good fix though.
> jobtoken location property in jobconf refers to wrong jobtoken file
> -------------------------------------------------------------------
>
> Key: MAPREDUCE-3727
> URL: https://issues.apache.org/jira/browse/MAPREDUCE-3727
> Project: Hadoop Map/Reduce
> Issue Type: Bug
> Components: security
> Affects Versions: 1.0.0
> Reporter: Alejandro Abdelnur
> Assignee: Alejandro Abdelnur
> Priority: Critical
> Fix For: 1.1.0
>
>
> Oozie launcher job (for MR/Pig/Hive/Sqoop action) reads the location of the
> jobtoken file from the *HADOOP_TOKEN_FILE_LOCATION* ENV var and seeds it as
> the *mapreduce.job.credentials.binary* property in the jobconf that will be
> used to launch the real (MR/Pig/Hive/Sqoop) job.
> The MR/Pig/Hive/Sqoop submission code (via Hadoop job submission) uses
> correctly the injected *mapreduce.job.credentials.binary* property to load
> the credentials and submit their MR jobs.
> The problem is that the *mapreduce.job.credentials.binary* property also
> makes it to the tasks of the MR/Pig/Hive/Sqoop MR jobs.
> If for some reason the MR/Pig/Hive/Sqoop MR code does some logic that
> triggers the credential loading, because the property is set, the credential
> loading fails trying to load a jobtoken file of the launcher job which does
> not exists in the context of the MR/Pig/Hive/Sqoop jobs.
> More specifically, we are seeing this happening with certain hive queries
> that trigger a conditional code within their RowContainer which then uses the
> FileInputFormat.getSplits() and then the TokenCache tries to load credentials
> for a file that is for the wrong job.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
