Mailing-List: contact mapreduce-issues-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
Reply-To: mapreduce-issues@hadoop.apache.org
Date: Thu, 7 Jun 2012 17:06:23 +0000 (UTC)
From: "Harsh J (JIRA)" <jira@apache.org>
To: mapreduce-issues@hadoop.apache.org
Message-ID: <428142990.48541.1339088783355.JavaMail.jiratomcat@issues-vm>
In-Reply-To: <342048901.48377.1339086442994.JavaMail.jiratomcat@issues-vm>
Subject: [jira] [Updated] (MAPREDUCE-4324) JobClient can perhaps set
 mapreduce.job.credentials.binary rather than expect its presence?
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable


     [ https://issues.apache.org/jira/browse/MAPREDUCE-4324?page=3Dcom.atla=
ssian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Harsh J updated MAPREDUCE-4324:
-------------------------------

    Component/s: security
   =20
> JobClient can perhaps set mapreduce.job.credentials.binary rather than ex=
pect its presence?
> -------------------------------------------------------------------------=
------------------
>
>                 Key: MAPREDUCE-4324
>                 URL: https://issues.apache.org/jira/browse/MAPREDUCE-4324
>             Project: Hadoop Map/Reduce
>          Issue Type: Bug
>          Components: mrv1, mrv2, security
>    Affects Versions: 0.22.0, 2.0.0-alpha
>            Reporter: Harsh J
>            Assignee: Harsh J
>
> HDFS-1007 added in this requirement property "mapreduce.job.credentials.b=
inary", that has lead Oozie to add the following duplicate snippet to all i=
ts Job-launching main classes such as the Pig, Hive, MR and Sqoop actions:
> {code}
> if (System.getenv("HADOOP_TOKEN_FILE_LOCATION") !=3D null) {
>             jobConf.set("mapreduce.job.credentials.binary", System.getenv=
("HADOOP_TOKEN_FILE_LOCATION"));
> }
> {code}
> Same is required for any client program that launches a job from within a=
 task.
> Why can't this simply be set by the JobClient initialization bits itself?=
 If no one imagines it causing issues, I'd like to add this snippet somewhe=
re in JobSubmitter before it requests NN/JT, as otherwise we'd get=E2=80=A6
> {code}
> org.apache.hadoop.ipc.RemoteException: java.io.IOException: Delegation To=
ken can be issued only with kerberos or web authentication=20
> at org.apache.hadoop.hdfs.server.namenode.FSNamesystem.getDelegationToken=
(FSNamesystem.java:5509)=20
> at org.apache.hadoop.hdfs.server.namenode.NameNode.getDelegationToken(Nam=
eNode.java:536)=20
> at sun.reflect.GeneratedMethodAccessor31.invoke(Unknown Source)=20
> at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccess=
orImpl.java:25)=20
> at java.lang.reflect.Method.invoke(Method.java:597)=20
> at org.apache.hadoop.ipc.RPC$Server.call(RPC.java:557)=20
> at org.apache.hadoop.ipc.Server$Handler$1.run(Server.java:1434)=20
> at org.apache.hadoop.ipc.Server$Handler$1.run(Server.java:1430)=20
> at java.security.AccessController.doPrivileged(Native Method)=20
> at javax.security.auth.Subject.doAs(Subject.java:396)=20
> at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformat=
ion.java:1157)=20
> at org.apache.hadoop.ipc.Server$Handler.run(Server.java:1428)
> at org.apache.hadoop.ipc.Client.call(Client.java:1107)=20
> at org.apache.hadoop.ipc.RPC$Invoker.invoke(RPC.java:226)=20
> at $Proxy6.getDelegationToken(Unknown Source)=20
> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)=20
> at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.j=
ava:39)=20
> at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccess=
orImpl.java:25)=20
> at java.lang.reflect.Method.invoke(Method.java:597)=20
> at org.apache.hadoop.io.retry.RetryInvocationHandler.invokeMethod(RetryIn=
vocationHandler.java:82)=20
> at org.apache.hadoop.io.retry.RetryInvocationHandler.invoke(RetryInvocati=
onHandler.java:59)=20
> at $Proxy6.getDelegationToken(Unknown Source)=20
> at org.apache.hadoop.hdfs.DFSClient.getDelegationToken(DFSClient.java:331=
)=20
> at org.apache.hadoop.hdfs.DistributedFileSystem.getDelegationToken(Distri=
butedFileSystem.java:605)=20
> at org.apache.hadoop.mapreduce.security.TokenCache.obtainTokensForNamenod=
esInternal(TokenCache.java:115)=20
> at org.apache.hadoop.mapreduce.security.TokenCache.obtainTokensForNamenod=
es(TokenCache.java:79)=20
> at org.apache.hadoop.mapred.JobClient$2.run(JobClient.java:851)=20
> at org.apache.hadoop.mapred.JobClient$2.run(JobClient.java:833)=20
> at java.security.AccessController.doPrivileged(Native Method)=20
> at javax.security.auth.Subject.doAs(Subject.java:396)=20
> at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformat=
ion.java:1157)=20
> at org.apache.hadoop.mapred.JobClient.submitJobInternal(JobClient.java:83=
3)=20
> at org.apache.hadoop.mapred.JobClient.submitJob(JobClient.java:807)=20
> at org.apache.hadoop.mapred.JobClient.runJob(JobClient.java:1242)=20
> {code}
> =E2=80=A6 or similar errors when a user submits a job from a task running=
 in a secured cluster.
> Let me know your thoughts on this!

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrato=
rs: https://issues.apache.org/jira/secure/ContactAdministrators!default.jsp=
a
For more information on JIRA, see: http://www.atlassian.com/software/jira