[FLINK-23356][hbase] Do not use delegation token in case of keytab

Closes apache#16466
zhuoluoy · Jul 13, 2021 · 657df14 · 657df14
1 parent 5aba616
commit 657df14
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/flink-runtime/src/main/java/org/apache/flink/runtime/security/modules/HadoopModule.java b/flink-runtime/src/main/java/org/apache/flink/runtime/security/modules/HadoopModule.java
@@ -92,11 +92,13 @@ public void install() throws SecurityInstallException {
                     // and does not fallback to using Kerberos tickets
                     Credentials credentialsToBeAdded = new Credentials();
                     final Text hdfsDelegationTokenKind = new Text("HDFS_DELEGATION_TOKEN");
+                    final Text hbaseDelegationTokenKind = new Text("HBASE_AUTH_TOKEN");
                     Collection<Token<? extends TokenIdentifier>> usrTok =
                             credentialsFromTokenStorageFile.getAllTokens();
-                    // If UGI use keytab for login, do not load HDFS delegation token.
+                    // If UGI use keytab for login, do not load HDFS/HBase delegation token.
                     for (Token<? extends TokenIdentifier> token : usrTok) {
-                        if (!token.getKind().equals(hdfsDelegationTokenKind)) {
+                        if (!token.getKind().equals(hdfsDelegationTokenKind)
+                                && !token.getKind().equals(hbaseDelegationTokenKind)) {
                             credentialsToBeAdded.addToken(token.getService(), token);
                         }
                     }