mirror of
https://github.com/apache/doris.git
synced 2026-11-04 07:31:17 +00:00
Calvin Kirs
77893fb6a4
### What problem does this PR solve? Issue Number: close #xxx Related PR: #62023 Problem Summary: The regression case `test_two_hive_kerberos` fails intermittently with: ``` GSSException: No valid credentials provided ... Caused by: javax.security.auth.login.LoginException: Cannot read from System.in ``` Root cause: the `KerberosHadoopAuthenticator` in `fe-filesystem-hdfs` (introduced in #62023) relies on Hadoop's `UserGroupInformation.checkTGTAndReloginFromKeytab()`, which has a hard-coded 60s relogin throttle (`hasSufficientTimeElapsed`). When the TGT expires inside that throttle window, the relogin is silently skipped, the subsequent SASL handshake finds no valid ticket, and the JAAS fallback path tries to prompt on `System.in` — which fails in a server process. Fix: replace the throttled reactive relogin with trino's proactive TGT refresh model (ported 1:1 from trino 435 `KerberosAuthentication` / `CachingKerberosHadoopAuthentication` / `KerberosTicketUtils`): - Login eagerly at construction with explicit JAAS options (`doNotPrompt=true`, `useKeyTab=true`, `storeKey=true`, `isInitiator=true`) — `doNotPrompt=true` makes the `System.in` prompt path impossible. - Compute the next refresh time as ticket start + 80% of ticket lifetime. - On each `doAs`, if past the refresh point, perform a fresh keytab login (no throttle) and swap the new credentials into the existing `Subject` in place, so the cached UGI stays valid. - A failed refresh does not advance the refresh time, so the next call retries immediately; the failure is wrapped as `IOException` to keep the SPI's checked-exception contract. The vendored `KerberosTicketUtils` is placed in `fe-foundation` (`org.apache.doris.foundation.security`) and provided to filesystem plugins through `fe-filesystem-spi`, which also lets `fe-common`'s `HadoopKerberosAuthenticator` drop its `io.trino` import. ### Release note None ### Check List (For Author) - Test <!-- At least one of them must be included. --> - [ ] Regression test - [x] Unit Test - [ ] Manual test (add detailed scripts or steps below) - [ ] No need to test or manual test. Explain why: - [ ] This is a refactor/code format and no logic has been changed. - [ ] Previous test can cover this change. - [ ] No code files have been changed. - [ ] Other reason <!-- Add your reason? --> - Behavior changed: - [ ] No. - [x] Yes. <!-- Explain the behavior change --> Kerberos keytab relogin in fe-filesystem-hdfs is now proactive (refresh at 80% of TGT lifetime, unthrottled) instead of Hadoop's reactive relogin with a 60s throttle.
37 lines
1.2 KiB
Bash
Executable File
37 lines
1.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Licensed to the Apache Software Foundation (ASF) under one
|
|
# or more contributor license agreements. See the NOTICE file
|
|
# distributed with this work for additional information
|
|
# regarding copyright ownership. The ASF licenses this file
|
|
# to you under the Apache License, Version 2.0 (the
|
|
# "License"); you may not use this file except in compliance
|
|
# with the License. You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing,
|
|
# software distributed under the License is distributed on an
|
|
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
# KIND, either express or implied. See the License for the
|
|
# specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
set -eo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
|
|
|
|
export DORIS_HOME="${ROOT}/../.."
|
|
. "${DORIS_HOME}/env.sh"
|
|
|
|
export CDC_CLIENT_HOME="${ROOT}"
|
|
|
|
bash "${DORIS_HOME}"/generated-source.sh noclean
|
|
cd "${DORIS_HOME}/fe"
|
|
"${MVN_CMD}" -Pflatten install -pl fe-common -am -Dskip.doc=true -DskipTests -Dmaven.build.cache.enabled=false
|
|
|
|
echo "Install cdc client..."
|
|
cd "${CDC_CLIENT_HOME}"
|
|
"${MVN_CMD}" package -DskipTests
|
|
|
|
echo "Finished"
|