hive icon indicating copy to clipboard operation
hive copied to clipboard

HIVE-28042: DigestMD5 token expired or does not exist issue while opening connection to HMS

Open vikramahuja1001 opened this issue 1 year ago • 3 comments

What changes were proposed in this pull request?

Adding two changes to fix this issue:

  1. Rework expiry thread to not remove token after renewal time has passed for that particular token. It will actually try to renew the token in this case.
  2. Individual calls to retrievePassword during the TSaslClientTransport auth will also try to renew the token if required before retrieving the password.

Why are the changes needed?

Facing DigestMD5 token expiry issue in a session which has been open since a long time when a new new connection is opened to HMS using TSaslClientTransport with DigestMD5 based auth. This issue is happening due to the fact that the new connection is trying to authenticate using the token identifier which is removed by the expiry thread in the background.

Does this PR introduce any user-facing change?

No

Is the change a dependency upgrade?

No

How was this patch tested?

Added a test case to check the expiry thread renewing the token automatically after some time and removing a token automatically after the token has expired. Tested the scenario on a machine with dedicated HMS, HS2 with Sasl enabled. Added a test case to test the complete scenario of creating a new HMSClient after another.

vikramahuja1001 avatar Jun 14 '24 13:06 vikramahuja1001

Continuation of Old PR: https://github.com/apache/hive/pull/5049

vikramahuja1001 avatar Jun 14 '24 13:06 vikramahuja1001

@chinnaraolalam @zhangbutao @alanfgates, could you guys please review this PR?

vikramahuja1001 avatar Jun 17 '24 05:06 vikramahuja1001