question Re: delegation token and block token question in Archives of Support Questions (Read Only)

delegation token and block token question

mokkan — Fri, 16 Sep 2022 13:16:15 GMT

As far as I know after kerberos authentication is established, we can get delegation token and even if we kdestroy the tickets, we can still access using delegation token. Is delegation token part of kerberos or just depend on kereberos? Is it just a separate pacakge?

Re: delegation token and block token question

falbani — Thu, 24 May 2018 21:20:50 GMT

@Mokkan Mok

1. We can get delegation token and even if we kdestroy the tickets, we can still access using delegation token?

Yes, the following hc link shows exactly this with an example

https://community.hortonworks.com/articles/50069/demystifying-delegation-token.html

2. Is delegation token part of kerberos or just depend on kereberos?

Delegation token is not part of kerberos. But in order to get a delegation token you need to have a valid kerberos token.

3. Is it just a separate package?

Each hadooop service like HDFS, YARN, HIVE, HBASE client api provides a way to fetch delegation tokens. Each delagation token has expiration and max issue date. As long as is valid clients can use the delegation token to authenticate with the service.

HTH

*** If you found this answer addressed your question, please take a moment to login and click the "accept" link on the answer.

Re: delegation token and block token question

mokkan — Thu, 24 May 2018 21:31:04 GMT

Thanks a lot for giving great explanation. Just a last question, delegation token is given by NN, from NN what package or what tool provides the delegation token. Is it part of namenode package?

Re: delegation token and block token question

falbani — Thu, 24 May 2018 21:33:58 GMT

@Mokkan Mok

Yes, Namenode gives the delegation token. Command line tool is:

# hdfs fetchdt

Re: delegation token and block token question

mokkan — Thu, 24 May 2018 21:39:58 GMT

Thanks a lot.