hadoop-yarn-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Robert Kanter (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (YARN-6602) Impersonation does not work if standby RM is contacted first
Date Mon, 15 May 2017 18:43:04 GMT

    [ https://issues.apache.org/jira/browse/YARN-6602?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16011094#comment-16011094
] 

Robert Kanter commented on YARN-6602:
-------------------------------------

>From what I can tell, the client doesn't get an RM token even in the working case.  Somehow,
{{UserGroupInformation.getCurrentUser()}} in the active RM (when processing the app submission)
is different in each case:
{noformat:title=Working Case}
foo (auth:PROXY) via oozie/host@REALM (auth:KERBEROS)
{noformat}
{noformat:title=Non-Working Case}
oozie/host@REALM (auth:KERBEROS)
{noformat}

> Impersonation does not work if standby RM is contacted first
> ------------------------------------------------------------
>
>                 Key: YARN-6602
>                 URL: https://issues.apache.org/jira/browse/YARN-6602
>             Project: Hadoop YARN
>          Issue Type: Bug
>          Components: client
>    Affects Versions: 3.0.0-alpha3
>            Reporter: Robert Kanter
>            Assignee: Robert Kanter
>            Priority: Blocker
>
> When RM HA is enabled, impersonation does not work correctly if the Yarn Client connects
to the standby RM first.  When this happens, the impersonation is "lost" and the client does
things on behalf of the impersonator user.  We saw this with the OOZIE-1770 Oozie on Yarn
feature.
> I need to investigate this some more, but it appears to be related to delegation tokens.
 When this issue occurs, the tokens have the owner as "oozie" instead of the actual user.
 On a hunch, we found a workaround that explicitly adding a correct RM HA delegation token
fixes the problem:
> {code:java}
> org.apache.hadoop.yarn.api.records.Token token = yarnClient.getRMDelegationToken(ClientRMProxy.getRMDelegationTokenService(conf));
> org.apache.hadoop.security.token.Token token2 = new org.apache.hadoop.security.token.Token(token.getIdentifier().array(),
token.getPassword().array(), new Text(token.getKind()), new Text(token.getService()));
> UserGroupInformation.getCurrentUser().addToken(token2);
> {code}



--
This message was sent by Atlassian JIRA
(v6.3.15#6346)

---------------------------------------------------------------------
To unsubscribe, e-mail: yarn-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: yarn-issues-help@hadoop.apache.org


Mime
View raw message