[jira] [Commented] (HADOOP-13807) UGI renewal thread should be spawn only if the keytaab is not external

[Xiao Chen (JIRA)]

[ 
https://issues.apache.org/jira/browse/HADOOP-13807?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15677475#comment-15677475
 ] 

Xiao Chen commented on HADOOP-13807:


Thanks [~tucu00] for reporting this.

Do you have the warn logs? Could be helpful to see what the exception is. (Too 
bad only versions [only log the exception 
message|https://github.com/apache/hadoop/blob/d0a347984da175948b553a675dc357491df2fd0f/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java#L994],
 but that's still something...)

Looking at the code I think this (HADOOP-13807) and HADOOP-13805 are mutual 
exclusive: this only happens when {{isKeytab}} is false, and HADOOP-13805 only 
happens when {{isKeytab}} is true... Whether the keytab is external seems to 
only impact {{keytabFile}} parameter. Am I missing something?

> UGI renewal thread should be spawn only if the keytaab is not external
> --
>
> Key: HADOOP-13807
> URL: https://issues.apache.org/jira/browse/HADOOP-13807
> Project: Hadoop Common
>  Issue Type: Bug
>  Components: security
>Affects Versions: 2.7.2, 2.6.4, 3.0.0-alpha1
>Reporter: Alejandro Abdelnur
>Priority: Minor
>
> The renewal thread should not be spawned if the keytab is external.
> Because of HADOOP-13805 there can be a case that an UGI does not have a 
> keytab because authentication is managed by the host program. In such case we 
> should not spawn the renewal thread.
> Currently this is logging a warning "Exception encountered while running the 
> renewal command. Aborting renew thread. " and exiting the thread. The warning 
> may be misleading and running the thread is not really needed.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

-
To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org
For additional commands, e-mail: common-issues-h...@hadoop.apache.org

[jira] [Commented] (HADOOP-13807) UGI renewal thread should be spawn only if the keytaab is not external

[Alejandro Abdelnur (JIRA)]

[ 
https://issues.apache.org/jira/browse/HADOOP-13807?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15654094#comment-15654094
 ] 

Alejandro Abdelnur commented on HADOOP-13807:
-


The following method in the UGI should add to the following IF condition {{&& 
!externalKeyTab}}:

{code}
  private void spawnAutoRenewalThreadForUserCreds() {
if (isSecurityEnabled()) {
  //spawn thread only if we have kerb credentials
  if (user.getAuthenticationMethod() == AuthenticationMethod.KERBEROS &&
  !isKeytab) {
Thread t = new Thread(new Runnable() {
  ..
{code}

> UGI renewal thread should be spawn only if the keytaab is not external
> --
>
> Key: HADOOP-13807
> URL: https://issues.apache.org/jira/browse/HADOOP-13807
> Project: Hadoop Common
>  Issue Type: Bug
>  Components: security
>Affects Versions: 2.7.2, 2.6.4, 3.0.0-alpha1
>Reporter: Alejandro Abdelnur
>Priority: Minor
>
> The renewal thread should not be spawned if the keytab is external.
> Because of HADOOP-13805 the can be a case that an UGI does not have a keytab 
> because authentication is managed by the host program. In such case we should 
> not spawn the renewal thread.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

-
To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org
For additional commands, e-mail: common-issues-h...@hadoop.apache.org