Cascading/cascading.hbase — pull request #2 by branky (2013-11-07 10:48:03+00:00)
Title: HBase Security

Within a secured Hadoop cluster (Kerberos authentication enabled), just like delegation tokens are required to access HDFS data and run MapReduce jobs, a token is also need to interact with HBase.

Current implementation of HBaseTap doesn't handle token, read and write data from/to will get exceptions:

```
Caused by: GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)
at sun.security.jgss.krb5.Krb5InitCredential.getInstance(Krb5InitCredential.java:130)
at sun.security.jgss.krb5.Krb5MechFactory.getCredentialElement(Krb5MechFactory.java:106)
at sun.security.jgss.krb5.Krb5MechFactory.getMechanismContext(Krb5MechFactory.java:172)
at sun.security.jgss.GSSManagerImpl.getMechanismContext(GSSManagerImpl.java:209)
at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:195)
at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:162)
at com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:175)
... 55 more
2013-11-06 22:28:12,807 WARN cascading.tap.hadoop.io.MultiInputFormat: unable to get record reader, but not retryingjava.io.IOException: Cannot create a record reader because of a previous error. Please look at the previous logs lines from the task's full log for more details.
at cascading.hbase.helper.TableInputFormatBase.getRecordReader(TableInputFormatBase.java:93)
at cascading.tap.hadoop.io.MultiInputFormat$1.operate(MultiInputFormat.java:252)
at cascading.tap.hadoop.io.MultiInputFormat$1.operate(MultiInputFormat.java:247
at cascading.util.Util.retry(Util.java:730)
at cascading.tap.hadoop.io.MultiInputFormat.getRecordReader(MultiInputFormat.java:246)
at org.apache.hadoop.mapred.MapTask$TrackedRecordReader.(MapTask.java:190)
at org.apache.hadoop.mapred.MapTask.runOldMapper(MapTask.java:411)
```

```
org.apache.hadoop.hbase.security.AccessDeniedException:
at cascading.hbase.HBaseTap.sinkConfInit(HBaseTap.java:53)
at cascading.hbase.HBaseTapCollector.initialize(HBaseTapCollector.java:83)
at cascading.hbase.HBaseTapCollector.prepare(HBaseTapCollector.java:74)
at cascading.hbase.HBaseTap.openForWrite(HBaseTap.java:147)
at cascading.hbase.HBaseTap.openForWrite(HBaseTap.java:53)
at cascading.flow.stream.SinkStage.prepare(SinkStage.java:60)
at cascading.flow.stream.StreamGraph.prepare(StreamGraph.java:167)
at cascading.flow.hadoop.FlowMapper.run(FlowMapper.java:110)
at org.apache.hadoop.mapred.MapTask.runOldMapper(MapTask.java:429)
at org.apache.hadoop.mapred.MapTask.run(MapTask.java:365)
at org.apache.hadoop.mapred.Child$4.run(Child.java:255)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAs(Subject.java:396)
at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1232)
at org.apache.hadoop.mapred.Child.main(Child.java:249)
```