[jira] [Created] (HADOOP-19212) org.apache.hadoop.security.UserGroupInformation use of Subject needs to move to replacement APIs

["Alan Bateman (Jira)" <ji...@apache.org>]

Alan Bateman created HADOOP-19212:
-------------------------------------

             Summary: org.apache.hadoop.security.UserGroupInformation use of Subject needs to move to replacement APIs
                 Key: HADOOP-19212
                 URL: https://issues.apache.org/jira/browse/HADOOP-19212
             Project: Hadoop Common
          Issue Type: Bug
          Components: security
            Reporter: Alan Bateman


`javax.security.auth.Subject.getSubject` and `Subject.doAs` were deprecated for removal in JDK 17. The replacement APIs are `Subject.current` and `callAs`. See [JEP 411|[https://openjdk.org/jeps/411]] for backgorund.

The `Subject.getSubject` API has been "degraded" in JDK 23 to throw `UnsupportedOperationException` if not running with the option to allow a SecurityManager. In a future JDK release, the `Subject.getSubject` API will be degraded further to throw`UnsupportedOperationException` unconditionally.

[renaissance/issues/439|[https://github.com/renaissance-benchmarks/renaissance/issues/439]] is a failure with a Spark benchmark due to the code in `org.apache.hadoop.security.UserGroupInformation` using the deprecated `Subject.getSubject` method. The maintainers of this code need to move to the the replacement APIs to ensure that this code will continue to work once the security manager feature is removed.

 

 

 

 



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: common-dev-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-dev-help@hadoop.apache.org