Browse Source

Updated to address Todd's comments.

Aaron T. Myers 15 years ago
parent
commit
cd022ae6dc

+ 12 - 0
apps/jobsub/src/jobsub/java/src/org/apache/hadoop/security/JobClientTrace.aj

@@ -35,6 +35,18 @@ public aspect JobClientTrace {
     return ret;
   }
 
+  /**
+   * The JobClient assumes that the user is authenticated via kerberos for the
+   * purpose of job submission, and thus that delegation tokens for the NN(s)
+   * can be retrieved. This doesn't work, however, in the case that the job is
+   * actually being submitted to the JT via an MR delegation token, because new
+   * delegation tokens can't be retrieved if one is only authenticated via
+   * delegation tokens. The work-around here is to pre-fetch NN delegation
+   * tokens from jobsubd, and pass them in. We set the
+   * <code>mapreduce.job.credentials.binary</code> here because this happens
+   * immediately before we try to fill the token cache with delegation tokens
+   * from the NN(s).
+   */
   void around(Configuration conf, Credentials credentials):
     call(void JobClient.readTokensFromFiles(Configuration, Credentials)) && args(conf, credentials) {
     conf.set("mapreduce.job.credentials.binary", System.getenv("HADOOP_TOKEN_FILE_LOCATION"));