HADOOP-15060. TestShellBasedUnixGroupsMapping.testFiniteGroupResolutionTime flaky. Contributed by Miklos Szegedi.

hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ShellBasedUnixGroupsMapping.java

@@ -157,6 +157,32 @@ protected String[] getGroupsIDForUserCommand(String userName) {
     return Shell.getGroupsIDForUserCommand(userName);
   }
 
+  /**
+   * Check if the executor had a timeout and logs the event.
+   * @param executor to check
+   * @param user user to log
+   * @return true if timeout has occurred
+   */
+  private boolean handleExecutorTimeout(
+      ShellCommandExecutor executor,
+      String user) {
+    // If its a shell executor timeout, indicate so in the message
+    // but treat the result as empty instead of throwing it up,
+    // similar to how partial resolution failures are handled above
+    if (executor.isTimedOut()) {
+      LOG.warn(
+          "Unable to return groups for user '{}' as shell group lookup " +
+              "command '{}' ran longer than the configured timeout limit of " +
+              "{} seconds.",
+          user,
+          Joiner.on(' ').join(executor.getExecString()),
+          timeout
+      );
+      return true;
+    }
+    return false;
+  }
+
   /**
    * Get the current user's group list from Unix by running the command 'groups'
    * NOTE. For non-existing user it will return EMPTY list.
@@ -174,6 +200,9 @@ private List<String> getUnixGroups(String user) throws IOException {
       executor.execute();
       groups = resolveFullGroupNames(executor.getOutput());
     } catch (ExitCodeException e) {
+      if (handleExecutorTimeout(executor, user)) {
+        return EMPTY_GROUPS;
+      } else {
         try {
           groups = resolvePartialGroupNames(user, e.getMessage(),
               executor.getOutput());
@@ -181,19 +210,9 @@ private List<String> getUnixGroups(String user) throws IOException {
           LOG.warn("unable to return groups for user {}", user, pge);
           return EMPTY_GROUPS;
         }
+      }
     } catch (IOException ioe) {
-      // If its a shell executor timeout, indicate so in the message
+      if (handleExecutorTimeout(executor, user)) {
-      // but treat the result as empty instead of throwing it up,
-      // similar to how partial resolution failures are handled above
-      if (executor.isTimedOut()) {
-        LOG.warn(
-            "Unable to return groups for user '{}' as shell group lookup " +
-            "command '{}' ran longer than the configured timeout limit of " +
-            "{} seconds.",
-            user,
-            Joiner.on(' ').join(executor.getExecString()),
-            timeout
-        );
         return EMPTY_GROUPS;
       } else {
         // If its not an executor timeout, we should let the caller handle it