[jira] [Commented] (HDFS-17128) RBF: SQLDelegationTokenSecretManager should use version of tokens updated by other routers

["ASF GitHub Bot (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/HDFS-17128?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17749453#comment-17749453 ] 

ASF GitHub Bot commented on HDFS-17128:
---------------------------------------

slfan1989 commented on code in PR #5897:
URL: https://github.com/apache/hadoop/pull/5897#discussion_r1280112864


##########
hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/SQLDelegationTokenSecretManager.java:
##########
@@ -153,36 +161,60 @@ protected void removeStoredToken(TokenIdent ident) throws IOException {
     }
   }
 
+  @Override
+  protected void removeExpiredStoredToken(TokenIdent ident) {
+    try {
+      // Ensure that the token has not been renewed in SQL by
+      // another secret manager
+      DelegationTokenInformation tokenInfo = getTokenInfoFromSQL(ident);
+      if (tokenInfo.getRenewDate() >= Time.now()) {
+        LOG.info("Token was renewed by a different router and has not been deleted: " + ident);

Review Comment:
   LOG.info("Token was renewed by a different router and has not been deleted: {}", ident);





> RBF: SQLDelegationTokenSecretManager should use version of tokens updated by other routers
> ------------------------------------------------------------------------------------------
>
>                 Key: HDFS-17128
>                 URL: https://issues.apache.org/jira/browse/HDFS-17128
>             Project: Hadoop HDFS
>          Issue Type: Improvement
>          Components: rbf
>            Reporter: Hector Sandoval Chaverri
>            Priority: Major
>              Labels: pull-request-available
>
> The SQLDelegationTokenSecretManager keeps tokens that it has interacted with in a memory cache. This prevents routers from connecting to the SQL server for each token operation, improving performance.
> We've noticed issues with some tokens being loaded in one router's cache and later renewed on a different one. If clients try to use the token in the outdated router, it will throw an "Auth failed" error when the cached token's expiration has passed.
> This can also affect cancelation scenarios since a token can be removed from one router's cache and still exist in another one.
> A possible solution is already implemented on the ZKDelegationTokenSecretManager, which consists of having an executor refreshing each router's cache on a periodic basis. We should evaluate whether this will work with the volume of tokens expected to be handled by the SQLDelegationTokenSecretManager.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: hdfs-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: hdfs-issues-help@hadoop.apache.org