You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@oozie.apache.org by "Rohini Palaniswamy (JIRA)" <ji...@apache.org> on 2012/12/26 21:04:12 UTC

[jira] [Updated] (OOZIE-1147) HCatCredentialHelper uses the wrong API for getDelegationToken

     [ https://issues.apache.org/jira/browse/OOZIE-1147?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Rohini Palaniswamy updated OOZIE-1147:
--------------------------------------

    Attachment: OOZIE-1147.patch

Found this issue while testing OOZIE-1125 in a secure cluster. No unit tests added/modified as this relates to security. 
                
> HCatCredentialHelper uses the wrong API for getDelegationToken
> --------------------------------------------------------------
>
>                 Key: OOZIE-1147
>                 URL: https://issues.apache.org/jira/browse/OOZIE-1147
>             Project: Oozie
>          Issue Type: Bug
>    Affects Versions: 3.3.0
>            Reporter: Rohini Palaniswamy
>            Assignee: Rohini Palaniswamy
>             Fix For: 3.3.1
>
>         Attachments: OOZIE-1147.patch
>
>
> HiveMetastoreClient.getDelegationToken(String renewerKerberosPrincipalName) is called instead of getDelegationToken(String owner, String renewerKerberosPrincipalName). This causes the delegation token to be fetched as the oozie service principal instead of the user submitting the job. So the jobs fail with access errors when using that wrong token. 

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira