diff --git a/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt b/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt
index 1d67bb8df40..86998de41cc 100644
--- a/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt
+++ b/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt
@@ -213,6 +213,9 @@ Release 0.23.3 - UNRELEASED
     HDFS-3099. SecondaryNameNode does not properly initialize metrics system.
     (atm)
 
+    HDFS-3062. Fix bug which prevented MR job submission from creating
+    delegation tokens on an HA cluster. (Mingjie Lai via todd)
+
   BREAKDOWN OF HDFS-1623 SUBTASKS
 
     HDFS-2179. Add fencing framework and mechanisms for NameNode HA. (todd)
diff --git a/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/DistributedFileSystem.java b/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/DistributedFileSystem.java
index 8dfced350a2..0e8e5adbf5c 100644
--- a/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/DistributedFileSystem.java
+++ b/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/DistributedFileSystem.java
@@ -840,4 +840,18 @@ public class DistributedFileSystem extends FileSystem {
   public void setBalancerBandwidth(long bandwidth) throws IOException {
     dfs.setBalancerBandwidth(bandwidth);
   }
+
+  /**
+   * Get a canonical service name for this file system. If the URI is logical,
+   * the hostname part of the URI will be returned.
+   * @return a service string that uniquely identifies this file system.
+   */
+  @Override
+  public String getCanonicalServiceName() {
+    if (HAUtil.isLogicalUri(getConf(), getUri())) {
+      return getUri().getHost();
+    } else {
+      return super.getCanonicalServiceName();
+    }
+  }
 }
diff --git a/hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/server/namenode/ha/TestDelegationTokensWithHA.java b/hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/server/namenode/ha/TestDelegationTokensWithHA.java
index 561e4d61033..60481af5db3 100644
--- a/hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/server/namenode/ha/TestDelegationTokensWithHA.java
+++ b/hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/server/namenode/ha/TestDelegationTokensWithHA.java
@@ -204,6 +204,17 @@ public class TestDelegationTokensWithHA {
     assertArrayEquals(token.getIdentifier(), token2.getIdentifier());
     assertArrayEquals(token.getPassword(), token2.getPassword());
   }
+
+  /**
+   * HDFS-3062: DistributedFileSystem.getCanonicalServiceName() throws an
+   * exception if the URI is a logical URI. This bug fails the combination of
+   * ha + mapred + security.
+   */
+  @Test
+  public void testDFSGetCanonicalServiceName() throws Exception {
+    assertEquals(fs.getCanonicalServiceName(), 
+        HATestUtil.getLogicalUri(cluster).getHost());
+  }
   
   enum TokenTestAction {
     RENEW, CANCEL;