hadoop-common-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Hadoop QA (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (HADOOP-11187) NameNode - KMS communication fails after a long period of inactivity
Date Tue, 04 Nov 2014 11:08:34 GMT

    [ https://issues.apache.org/jira/browse/HADOOP-11187?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14195998#comment-14195998
] 

Hadoop QA commented on HADOOP-11187:
------------------------------------

{color:red}-1 overall{color}.  Here are the results of testing the latest attachment 
  http://issues.apache.org/jira/secure/attachment/12679189/HADOOP-11187.1.patch
  against trunk revision 2bb327e.

    {color:green}+1 @author{color}.  The patch does not contain any @author tags.

    {color:green}+1 tests included{color}.  The patch appears to include 4 new or modified
test files.

    {color:green}+1 javac{color}.  The applied patch does not increase the total number of
javac compiler warnings.

    {color:green}+1 javadoc{color}.  There were no new javadoc warning messages.

    {color:green}+1 eclipse:eclipse{color}.  The patch built with eclipse:eclipse.

    {color:green}+1 findbugs{color}.  The patch does not introduce any new Findbugs (version
2.0.3) warnings.

    {color:green}+1 release audit{color}.  The applied patch does not increase the total number
of release audit warnings.

    {color:red}-1 core tests{color}.  The patch failed these unit tests in hadoop-common-project/hadoop-auth
hadoop-common-project/hadoop-common hadoop-common-project/hadoop-kms:

                  org.apache.hadoop.ha.TestZKFailoverControllerStress

    {color:green}+1 contrib tests{color}.  The patch passed contrib unit tests.

Test results: https://builds.apache.org/job/PreCommit-HADOOP-Build/5012//testReport/
Console output: https://builds.apache.org/job/PreCommit-HADOOP-Build/5012//console

This message is automatically generated.

> NameNode - KMS communication fails after a long period of inactivity
> --------------------------------------------------------------------
>
>                 Key: HADOOP-11187
>                 URL: https://issues.apache.org/jira/browse/HADOOP-11187
>             Project: Hadoop Common
>          Issue Type: Bug
>    Affects Versions: 2.6.0
>            Reporter: Arun Suresh
>            Assignee: Arun Suresh
>         Attachments: HADOOP-11187.1.patch
>
>
> As reported by [~atm] :
> The issue is due to the authentication token that the NN has to talk to the KMS is expiring,
AND the signature secret provider in the KMS authentication filter is discarding the old secret
after 2x the authentication token validity period.
> If the token being supplied is under 1x the validity lifetime then the token will authenticate
just fine. If the token being supplied is between 1x-2x the validity lifetime, then the token
can be validated but it will be expired, so a 401 will be returned to the client and it will
get a new token. But if the token being supplied is greater than 2x the validity lifetime,
then the KMS authentication filter will not even be able to validate the token, and will return
a 403, which will cause the client to not retry authentication to the KMS.
> The KMSClientProvider needs to be modified to retry authentication even in the above
case



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Mime
View raw message