Kousuke Saruta created SPARK-57896:
--------------------------------------
Summary: Add Kerberos coexistence and per-user token integration
tests
Key: SPARK-57896
URL: https://issues.apache.org/jira/browse/SPARK-57896
Project: Spark
Issue Type: Sub-task
Components: Spark Core, Tests
Affects Versions: 4.3.0
Reporter: Kousuke Saruta
This sub-task is part of the umbrella
[SPARK-57703|https://issues.apache.org/jira/browse/SPARK-57703] (OIDC
Credential Propagation).
h2. Problem
We need to verify that the new OIDC credential path does not interfere with
existing Kerberos delegation token handling, and that both workload-level and
per-user tokens work correctly.
h2. Goal
Comprehensive integration tests proving coexistence and correctness.
h2. Scope
* Integration test: local-mode job with
{{spark.security.credentials.enabled=true}} + Fake provider delivers
{{ServiceCredential}} to executors and refreshes on expiry
* Same test with per-user identity token as input
* Coexistence test: both {{UserCredentialManager}} and
{{HadoopDelegationTokenManager}} active simultaneously; failure in one does not
affect the other
* Verify no regressions in existing Kerberos delegation token test suite
h2. Acceptance criteria
* All new integration tests pass.
* Existing Kerberos delegation token tests pass without modification.
* Credential refresh works end-to-end in local mode.
* Per-user identity tokens produce valid credentials identically to workload
tokens.
Reference: [SPIP design document Q8 and Testing
plan|https://docs.google.com/document/d/1usJKncCPMiyFUg7aIdpZ0HQsklXIHow_sU_6dfFMjN0/edit].
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
