HADOOP-16881. KerberosAuthentication does not disconnect HttpURLConnection leading to CLOSE_WAIT cnxns. Contributed by Attila Magyar.

Signed-off-by: Wei-Chiu Chuang <weichiu@apache.org>

hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/client/KerberosAuthenticator.java

@@ -183,8 +183,9 @@ public class KerberosAuthenticator implements Authenticator {
     if (!token.isSet()) {
       this.url = url;
       base64 = new Base64(0);
+      HttpURLConnection conn = null;
       try {
-        HttpURLConnection conn = token.openConnection(url, connConfigurator);
+        conn = token.openConnection(url, connConfigurator);
         conn.setRequestMethod(AUTH_HTTP_METHOD);
         conn.connect();
 
@@ -218,6 +219,10 @@ public class KerberosAuthenticator implements Authenticator {
       } catch (AuthenticationException ex){
         throw wrapExceptionWithMessage(ex,
             "Error while authenticating with endpoint: " + url);
+      } finally {
+        if (conn != null) {
+          conn.disconnect();
+        }
       }
     }
   }

hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/web/DelegationTokenAuthenticator.java

@@ -312,8 +312,9 @@ public abstract class DelegationTokenAuthenticator implements Authenticator {
       dt = ((DelegationTokenAuthenticatedURL.Token) token).getDelegationToken();
       ((DelegationTokenAuthenticatedURL.Token) token).setDelegationToken(null);
     }
+    HttpURLConnection conn = null;
     try {
-      HttpURLConnection conn = aUrl.openConnection(url, token);
+      conn = aUrl.openConnection(url, token);
       conn.setRequestMethod(operation.getHttpMethod());
       HttpExceptionUtils.validateResponse(conn, HttpURLConnection.HTTP_OK);
       if (hasResponse) {
@@ -339,6 +340,9 @@ public abstract class DelegationTokenAuthenticator implements Authenticator {
       if (dt != null) {
         ((DelegationTokenAuthenticatedURL.Token) token).setDelegationToken(dt);
       }
+      if (conn != null) {
+        conn.disconnect();
+      }
     }
     return ret;
   }