You are viewing a plain text version of this content. The canonical link for it is here.
Posted to common-issues@hadoop.apache.org by "goiri (via GitHub)" <gi...@apache.org> on 2023/08/11 20:06:48 UTC
[GitHub] [hadoop] goiri commented on a diff in pull request #5921: HDFS-17138 RBF: We changed the hadoop.security.auth_to_local configur…
goiri commented on code in PR #5921:
URL: https://github.com/apache/hadoop/pull/5921#discussion_r1291733842
##########
hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenSecretManager.java:
##########
@@ -81,7 +81,12 @@ class AbstractDelegationTokenSecretManager<TokenIdent
= DelegationTokenSecretManagerMetrics.create();
private String formatTokenId(TokenIdent id) {
- return "(" + id + ")";
+ try {
+ return "(" + id + ")";
+ } catch (Exception e) {
+ LOG.warn("Exception in formatTokenId", e);
Review Comment:
What can this exception be?
##########
hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/security/TestDelegationToken.java:
##########
@@ -376,4 +382,61 @@ public void testDelegationTokenIdentifierToString() throws Exception {
" for SomeUser with renewer JobTracker",
dtId.toStringStable());
}
+
+ public static class MyDelegationTokenSecretManager extends
+ AbstractDelegationTokenSecretManager<DelegationTokenIdentifier> {
+ /**
+ * Create a secret manager
+ *
+ * @param delegationKeyUpdateInterval the number of milliseconds for rolling
+ * new secret keys.
+ * @param delegationTokenMaxLifetime the maximum lifetime of the delegation
+ * tokens in milliseconds
+ * @param delegationTokenRenewInterval how often the tokens must be renewed
+ * in milliseconds
+ * @param delegationTokenRemoverScanInterval how often the tokens are scanned
+ * for expired tokens in milliseconds
+ */
+ public MyDelegationTokenSecretManager(long delegationKeyUpdateInterval,
+ long delegationTokenMaxLifetime, long delegationTokenRenewInterval,
+ long delegationTokenRemoverScanInterval) {
+ super(delegationKeyUpdateInterval,
+ delegationTokenMaxLifetime,
+ delegationTokenRenewInterval,
+ delegationTokenRemoverScanInterval);
+ }
+
+ @Override
+ public DelegationTokenIdentifier createIdentifier() {
+ return null;
+ }
+
+ @Override
+ public void logExpireTokens(Collection<DelegationTokenIdentifier> expiredTokens) throws IOException {
+ super.logExpireTokens(expiredTokens);
+ }
+ }
+
+ @Test
+ public void testLogExpireTokensWhenChangeRules() {
+ MyDelegationTokenSecretManager myDtSecretManager =
+ new MyDelegationTokenSecretManager(10 * 1000, 10 * 1000, 10 * 1000, 10 * 1000);
+ setRules("RULE:[2:$1@$0](SomeUser.*)s/.*/SomeUser/");
+ DelegationTokenIdentifier dtId = new DelegationTokenIdentifier(
+ new Text("SomeUser/HOST@EXAMPLE.COM"),
+ new Text("SomeUser/HOST@EXAMPLE.COM"),
+ new Text("SomeUser/HOST@EXAMPLE.COM"));
+ Set<DelegationTokenIdentifier> expiredTokens = new HashSet();
+ expiredTokens.add(dtId);
+
+ setRules("RULE:[2:$1@$0](OtherUser.*)s/.*/OtherUser/");
+ // rules was modified, causing the existing tokens (May be loaded from other storage systems like zookeeper)
+ // to fail to match the kerberos rules,
+ // return an exception that cannot be handled
+ try {
+ myDtSecretManager.logExpireTokens(expiredTokens);
+ } catch (Exception e) {
+ Assert.fail("Exception in logExpireTokens");
Review Comment:
If you just let the exception go through, it will fail the test anyway.
##########
hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/security/TestDelegationToken.java:
##########
@@ -376,4 +382,61 @@ public void testDelegationTokenIdentifierToString() throws Exception {
" for SomeUser with renewer JobTracker",
dtId.toStringStable());
}
+
+ public static class MyDelegationTokenSecretManager extends
+ AbstractDelegationTokenSecretManager<DelegationTokenIdentifier> {
+ /**
+ * Create a secret manager
+ *
+ * @param delegationKeyUpdateInterval the number of milliseconds for rolling
+ * new secret keys.
+ * @param delegationTokenMaxLifetime the maximum lifetime of the delegation
+ * tokens in milliseconds
+ * @param delegationTokenRenewInterval how often the tokens must be renewed
+ * in milliseconds
+ * @param delegationTokenRemoverScanInterval how often the tokens are scanned
+ * for expired tokens in milliseconds
+ */
+ public MyDelegationTokenSecretManager(long delegationKeyUpdateInterval,
+ long delegationTokenMaxLifetime, long delegationTokenRenewInterval,
+ long delegationTokenRemoverScanInterval) {
+ super(delegationKeyUpdateInterval,
Review Comment:
Doesn't this happen automatically?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org