hadoop-common-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Chris Nauroth (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (HADOOP-12529) UserGroupInformation equals method depend on the subject object address
Date Sat, 31 Oct 2015 21:59:27 GMT

    [ https://issues.apache.org/jira/browse/HADOOP-12529?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14984176#comment-14984176
] 

Chris Nauroth commented on HADOOP-12529:
----------------------------------------

[~vinayrpet], I think in order to proceed with an optimization like that, we'd need to do
an exhaustive review of both Hadoop and downstream ecosystem projects to check if they use
any mutable operations on an instance returned from {{UserGroupInformation#createProxyUser}}.
 Existing calls to {{addToken}} or {{addCredentials}} on a proxy user would make it difficult
to proceed safely.

Interestingly, while browsing around, I noticed that Oozie maintains a cache of proxy user
instances, perhaps for this very reason.  The class is {{org.apache.oozie.service.UserGroupInformationService}}.
 This might imply that caching of proxy users is better handled as an application-specific
concern, where that application knows the full lifecycle and usage of those instances, instead
of at the core where we don't have that knowledge.

> UserGroupInformation equals method depend on the subject object address
> -----------------------------------------------------------------------
>
>                 Key: HADOOP-12529
>                 URL: https://issues.apache.org/jira/browse/HADOOP-12529
>             Project: Hadoop Common
>          Issue Type: Bug
>          Components: security
>    Affects Versions: 2.7.1
>            Reporter: wangwenli
>
>  my question is    why UserGroupInformation equals method depend on the subject object?
>        try below code which is extract from HiveMetaStore:
> {code:title=TestUgi.java|borderStyle=solid}
> UserGroupInformation clientUgi = null;
> UserGroupInformation clientUgi2 = null;
> try {
> clientUgi = UserGroupInformation.createProxyUser("user2", UserGroupInformation.getLoginUser());
> clientUgi2 = UserGroupInformation.createProxyUser("user2", UserGroupInformation.getLoginUser());
> if (clientUgi.equals(clientUgi2)) {
> System.out.println("==");
> } else {
> System.out.println("!=");           //  strangely  this will be hit
> }
> } catch (IOException e1) {
> e1.printStackTrace();
> }
> {code}
>       i found that it is because the equal method from UserGroupInformation is compare
on subject object ref : subject == ((UserGroupInformation) o).subject;  .    
>      as you know,   ipc.Client connect to namenode,   connections.get(ConnectionId) 
  this code will try to reuse the same socket to namenode, but because of ConnectionId's equal
depend on ugi equal, which will cause connections.get(ConnectionId) cann't get the same socket,
  suppose many connect to HiveMetaStore, then many connection to Namenode will established.
>       so my doubts is why UserGroupInformation is compare on subject object ref : subject
== ((UserGroupInformation) o).subject,   it should compare on subject's principal,  am i right?



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Mime
View raw message