Skip to content

[Common][BUG-FIX] Fix SecurityConfiguration.isLegal() to return false when no security config#7201

Open
jacklong319 wants to merge 1 commit intoapache:masterfrom
jacklong319:master
Open

[Common][BUG-FIX] Fix SecurityConfiguration.isLegal() to return false when no security config#7201
jacklong319 wants to merge 1 commit intoapache:masterfrom
jacklong319:master

Conversation

@jacklong319
Copy link

Purpose

Linked issue: #7146

This PR fixes a logic issue in SecurityConfiguration.isLegal() where it incorrectly returns true when no security configuration is provided, causing unnecessary security wrapper creation and checkpoint failures in Hadoop 2.7.5 environments.

Problem:

  • isLegal() returns true when both keytab and principal are empty
  • This causes HadoopSecuredFileSystem.trySecureFileSystem() to create unnecessary wrappers
  • All file operations are wrapped with ugi.doAs(), adding overhead
  • In Hadoop 2.7.5, this causes thread interruption issues during Flink checkpoints
  • Results in InterruptedIOException and HDFS block replica errors

Solution:

  • Change isLegal() to return false when no security configuration is provided
  • Add comment explaining why we return false in this case
  • Prevents HadoopSecuredFileSystem wrapper creation in non-Kerberos environments

Changes

  • Changed isLegal() to return false when both keytab and principal are empty
  • Added comment explaining why we return false in this case

Code Change:
// Before
return true;

// After
// Return false when no security configuration is provided to avoid
// unnecessary security wrapper creation in non-Kerberos environments
return false;

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant