YARN-5353. ResourceManager can leak delegation tokens when they are shared across apps. (Jason Lowe via Varun Saxena).

hadoop-yarn-project/CHANGES.txt

@@ -42,6 +42,9 @@ Release 2.6.5 - UNRELEASED
     YARN-4393. Fix intermittent test failure for TestResourceLocalizationService
     #testFailedDirsResourceRelease (Varun Saxana via rohithsharmaks)
 
+    YARN-5353. ResourceManager can leak delegation tokens when they are shared across
+    apps. (Jason Lowe via Varun Saxena)
+
 Release 2.6.4 - 2016-02-11
 
   INCOMPATIBLE CHANGES

hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/main/java/org/apache/hadoop/yarn/server/resourcemanager/security/DelegationTokenRenewer.java

@@ -712,7 +712,7 @@ public class DelegationTokenRenewer extends AbstractService {
 
   private void removeApplicationFromRenewal(ApplicationId applicationId) {
     rmContext.getSystemCredentialsForApps().remove(applicationId);
-    Set<DelegationTokenToRenew> tokens = appTokens.get(applicationId);
+    Set<DelegationTokenToRenew> tokens = appTokens.remove(applicationId);
 
     if (tokens != null && !tokens.isEmpty()) {
       synchronized (tokens) {
@@ -737,15 +737,10 @@ public class DelegationTokenRenewer extends AbstractService {
           // cancel the token
           cancelToken(dttr);
 
-          it.remove();
           allTokens.remove(dttr.token);
         }
       }
     }
-
-    if(tokens != null && tokens.isEmpty()) {
-      appTokens.remove(applicationId);
-    }
   }
 
   /**

hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/test/java/org/apache/hadoop/yarn/server/resourcemanager/security/TestDelegationTokenRenewer.java

@@ -1106,5 +1106,8 @@ public class TestDelegationTokenRenewer {
     Assert.assertTrue(dttr.referringAppIds.isEmpty());
     Assert.assertTrue(dttr.isTimerCancelled());
     Assert.assertTrue(Renewer.cancelled);
+
+    // make sure the token also has been removed from appTokens
+    Assert.assertFalse(renewer.getDelegationTokens().contains(token1));
   }
 }