hive icon indicating copy to clipboard operation
hive copied to clipboard

HIVE-28042: DigestMD5 token expired or does not exist issue while opening connection to HMS

Open vikramahuja1001 opened this issue 5 months ago • 2 comments

What changes were proposed in this pull request?

Adding three changes to fix this issue:

  1. Rework expiry thread to not remove token after renewal time has passed for that particular token. It will actually try to renew the token in this case.
  2. Individual calls to retrievePassword during the TSaslClientTransport auth will also try to renew the token if required before retrieving the password.
  3. Added a fallback mechanism to retry opening HMS connection using TSaslClientTransport with Kerberos auth in case the previous call fails with DigestMD5 auth.

Why are the changes needed?

Facing DigestMD5 token expiry issue in a session which has been open since a long time when a new new connection is opened to HMS using TSaslClientTransport with DigestMD5 based auth. This issue is happening due to the fact that the new connection is trying to authenticate using the token identifier which is removed by the expiry thread in the background.

Does this PR introduce any user-facing change?

No

Is the change a dependency upgrade?

No

How was this patch tested?

Added a test case to check the expiry thread renewing the token automatically after some time and removing a token automatically after the token has expired. Tested the scenario on a machine with dedicated HMS, HS2 with Sasl enabled.

vikramahuja1001 avatar Jan 30 '24 06:01 vikramahuja1001