Major Description
Basically what happens is, if a user login using full name with suffix then the user impersonation fails, as the HDFS expects username without the suffix.
This is because the username is passed to underlying components with suffix and got rejected in security layer with IllegalArgumentException
Error in delegation token service logs where the requests are rejected with IllegalArgumentException:
Caused by: java.lang.IllegalArgumentException: Illegal principal name adminuser1@testdomain.com: org.apache.hadoop.security.authentication.util.KerberosName$NoMatchingRule: No rules applied to adminuser1@testdomain.com
at org.apache.hadoop.security.User.<init>(User.java:51)
at org.apache.hadoop.security.User.<init>(User.java:43)
at org.apache.hadoop.security.UserGroupInformation.createProxyUser(UserGroupInformation.java:1283)
at com.sun.jersey.server.impl.inject.InjectableValuesProvider.getInjectableValues(InjectableValuesProvider.java:46)
... 42 more
Attachments
Issue Links
- links to
