[Authz] UserGroupInformation.setConfiguration() with sc.hadoopConfiguration before using it.

[minyk]

We currently do not use kyuubi-spark-authz module yet, still use old submarine plugin. But I think there is a same issue on kyuubi-spark-authz plugin.

Spark on K8S, Spark run on the container that has no specific user other than UID 185. In our case during ranger check, get groups of current user through UserGroupInformation.getGroupNames(). When doing this UserGroupInformation uses default configuration if not set, then ShellBasedUnixGroupsMapping is used and print warning message like this:

23/05/11 13:10:17 WARN ShellBasedUnixGroupsMapping: unable to return groups for user admin
PartialGroupNameException The user name 'admin' is not found. id: ‘admin’: no such user
id: ‘admin’: no such user

	at org.apache.hadoop.security.ShellBasedUnixGroupsMapping.resolvePartialGroupNames(ShellBasedUnixGroupsMapping.java:294)
	at org.apache.hadoop.security.ShellBasedUnixGroupsMapping.getUnixGroups(ShellBasedUnixGroupsMapping.java:207)
	at org.apache.hadoop.security.ShellBasedUnixGroupsMapping.getGroups(ShellBasedUnixGroupsMapping.java:97)
	at org.apache.hadoop.security.JniBasedUnixGroupsMappingWithFallback.getGroups(JniBasedUnixGroupsMappingWithFallback.java:51)
	at org.apache.hadoop.security.Groups$GroupCacheLoader.fetchGroupList(Groups.java:387)
...
	at org.apache.hadoop.security.Groups.getGroups(Groups.java:228)
	at org.apache.hadoop.security.UserGroupInformation.getGroups(UserGroupInformation.java:1734)
	at org.apache.hadoop.security.UserGroupInformation.getGroupNames(UserGroupInformation.java:1722)
	at org.apache.submarine.spark.security.RangerSparkAuthorizer$.checkPrivileges(RangerSparkAuthorizer.scala:56)
...

This is totally OK, but messy with long(86 lines) stack trace logs. So we make a small custom GroupsMapping class to address this. To apply it to the ranger plugin, we need to call UserGroupInformation.setConfiguration(spark.sparkContext.hadoopConfiguration) before use it. I think this is the right way to obtain hadoop configurations rather than confs from*-site.xml files or something else.

So I think kyuubi-spark-authz module also needs this call. If agreed, I'll make issue and PR.

Thank you

[yaooqinn]

we need to call UserGroupInformation.setConfiguration(spark.sparkContext.hadoopConfiguration)

Has this already been done by spark side?

[minyk]

@yaooqinn you're right. In the SparkHadoopUtil, there is a code for this. I'm confusing now.

[yaooqinn]

So maybe the SparkHadoopUtil.conf is inconsistent with spark.sparkContext.hadoopConfiguration?

[minyk]

UserGroupInformation is Initialized before auth plugin, but does not applied spark.hadoop.hadoop.security.group.mapping key. digging more up later.

[yaooqinn]

Looking forward to your feedback

[packyan]

+1, has the same problem.

[minyk]

@packyan currently we could not spend more time on this issue, we just a logger to log4j2.properties like this:

    logger.ShellBasedUnixGroupsMapping.name = org.apache.hadoop.security.ShellBasedUnixGroupsMapping
    logger.ShellBasedUnixGroupsMapping.level = error