Return-Path: 
 <common-issues-return-95522-apmail-hadoop-common-issues-archive=hadoop.apache.org@hadoop.apache.org>
X-Original-To: apmail-hadoop-common-issues-archive@minotaur.apache.org
Delivered-To: apmail-hadoop-common-issues-archive@minotaur.apache.org
Received: from mail.apache.org (hermes.apache.org [140.211.11.3])
	by minotaur.apache.org (Postfix) with SMTP id 46DE317A05
	for <apmail-hadoop-common-issues-archive@minotaur.apache.org>;
 Tue, 15 Sep 2015 19:56:46 +0000 (UTC)
Received: (qmail 70971 invoked by uid 500); 15 Sep 2015 19:56:46 -0000
Delivered-To: apmail-hadoop-common-issues-archive@hadoop.apache.org
Received: (qmail 70918 invoked by uid 500); 15 Sep 2015 19:56:46 -0000
Mailing-List: contact common-issues-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:common-issues-help@hadoop.apache.org>
List-Unsubscribe: <mailto:common-issues-unsubscribe@hadoop.apache.org>
List-Post: <mailto:common-issues@hadoop.apache.org>
List-Id: <common-issues.hadoop.apache.org>
Reply-To: common-issues@hadoop.apache.org
Delivered-To: mailing list common-issues@hadoop.apache.org
Received: (qmail 70903 invoked by uid 99); 15 Sep 2015 19:56:46 -0000
Received: from arcas.apache.org (HELO arcas.apache.org) (140.211.11.28)
    by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 15 Sep 2015 19:56:45 +0000
Date: Tue, 15 Sep 2015 19:56:45 +0000 (UTC)
From: "Hudson (JIRA)" <jira@apache.org>
To: common-issues@hadoop.apache.org
Message-ID: <JIRA.12864129.1442293373000.345731.1442347005943@Atlassian.JIRA>
In-Reply-To: <JIRA.12864129.1442293373000@Atlassian.JIRA>
References: <JIRA.12864129.1442293373000@Atlassian.JIRA>
 <JIRA.12864129.1442293373080@arcas>
Subject: [jira] [Commented] (HADOOP-12413) AccessControlList should avoid
 calling getGroupNames in isUserInList with empty groups.
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394


    [ https://issues.apache.org/jira/browse/HADOOP-12413?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14746038#comment-14746038 ] 

Hudson commented on HADOOP-12413:
---------------------------------

FAILURE: Integrated in Hadoop-Yarn-trunk-Java8 #395 (See [https://builds.apache.org/job/Hadoop-Yarn-trunk-Java8/395/])
HADOOP-12413. AccessControlList should avoid calling getGroupNames in isUserInList with empty groups. Contributed by Zhihai Xu. (cnauroth: rev b2017d9b032af20044fdf60ddbd1575a554ccb79)
* hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/AccessControlList.java
* hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/security/authorize/TestAccessControlList.java
* hadoop-common-project/hadoop-common/CHANGES.txt


> AccessControlList should avoid calling getGroupNames in isUserInList with empty groups.
> ---------------------------------------------------------------------------------------
>
>                 Key: HADOOP-12413
>                 URL: https://issues.apache.org/jira/browse/HADOOP-12413
>             Project: Hadoop Common
>          Issue Type: Improvement
>          Components: security
>    Affects Versions: 2.7.0
>            Reporter: zhihai xu
>            Assignee: zhihai xu
>             Fix For: 2.8.0
>
>         Attachments: HADOOP-12413.000.patch
>
>
> {{AccessControlList}} should avoid calling {{getGroupNames}} in {{isUserInList}} with empty {{groups}}. Currently {{AccessControlList}} will call {{ugi.getGroupNames()}} in {{isUserInList}} even if {{groups}} is empty. {{ugi.getGroupNames()}} is an expensive operation which call shell script {{id -gn <USER> && id -Gn <user>}} to get the list of groups. For example,
> {{ServiceAuthorizationManager#authorize}} will call blocked ACL {{acls[1].isUserAllowed(user)}} to check the user permission. The default value for blocked ACL  is empty
> {code}
>     String defaultBlockedAcl = conf.get(   CommonConfigurationKeys.HADOOP_SECURITY_SERVICE_AUTHORIZATION_DEFAULT_BLOCKED_ACL, "");
> {code}
> So every time {{authorize}} is called, {{getGroupNames}} may be called.
> It also caused the following warning message:
> {code}
> 2015-09-08 14:55:34,236 WARN [Socket Reader #1 for port 52715] org.apache.hadoop.security.ShellBasedUnixGroupsMapping: got exception trying to get groups for user job_1441722221553_0005: id: job_1441722221553_0005: No such user
> 2015-09-08 14:55:34,236 WARN [Socket Reader #1 for port 52715] org.apache.hadoop.security.UserGroupInformation: No groups available for user job_1441722221553_0005
> 2015-09-08 14:55:34,236 INFO [Socket Reader #1 for port 52715] SecurityLogger.org.apache.hadoop.security.authorize.ServiceAuthorizationManager: Authorization successful for job_1441722221553_0005 (auth:TOKEN) for protocol=interface org.apache.hadoop.mapred.TaskUmbilicalProtocol
> {code}



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)