remove old Kerberos ticket after relogin to make Kudu authentication work correctly#14373
Conversation
|
Does this PR fix #14441? |
|
Could you add a temporary commit for a stress test like #14393? |
|
@ebyhr for the release notes, do any other connectors utilize The bug is not kudu specific. |
|
@grantatspothero |
| try { | ||
| LoginContext loginContext = new LoginContext("", subject, null, configuration); | ||
| loginContext.login(); | ||
| synchronized (subject.getPrivateCredentials()) { |
There was a problem hiding this comment.
Why on subject.getPrivateCredentials() and not on subject?
Why do we need synchronize at all?
please capture reasoning as a code comment
|
+1 on @findepi 's comment, but otherwise LGTM. Thanks for adding a detailed description of the bug here |
|
I am not convinced this is the right fix, but it seems to help with test flakiness (#15990). Therefore I am merging this. @grantatspothero is following up with a better fix here #15997 cc @anusudarsan |
5 participants
Description
A bugfix to make authentication work correctly on a Kerberized Kudu cluster. Old Kerberos tickets may be used to make Kudu connections, it may lead to Kudu
UnrecoverableExceptionbeing raised when query Kudu's data even though relogin recently. Besides, next ticket refresh time is calculated based on the ticket'sstartTimeandendTime, a wrong result will lead to frequent access to the KDC. Remove old tickets after relogin can fix the issue.This PR fixes #14372
fixes #14441
Non-technical explanation
Remove old Kerberos ticket to avoid authentication check failures when access Kerberized Kudu clusters.
Release notes
( ) This is not user-visible or docs only and no release notes are required.
( ) Release notes are required, please propose a release note for me.
(x) Release notes are required, with the following suggested text: