You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@impala.apache.org by "Abhishek Rawat (Code Review)" <ge...@cloudera.org> on 2025/06/06 01:53:37 UTC
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Abhishek Rawat has uploaded this change for review. ( http://gerrit.cloudera.org:8080/22986
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
IMPALA-14083: Connected user and session user mismatch when cookie based
authentication is used with SPNEGO
IMPALA-11298 allowed comparing short user name for connected user and
session user to support proxy clients like Hue which could potentially
use different physical hosts for queries/requests from the same session.
When cookie based authentication is used, the 'kerberos_user_short' is
not set on the ConnectionContext and as a result 'connected_user_short'
is not set in SessionState. This can cause a mismatch when comparing
short user names from ConnectionContext and SessionState. This happens
because the original connection authenticated using SPNEGO will have
'kerberos_user_short' in the ConnectionContext, while the other
connections authenticated using cookies won't have 'kerberos_user_short'
set in the ConnectionContext.
This patch addresses this issue by setting 'connected_user_short' in
SessionState, if it's not set and HTTP transport is used for
OpenSession.
Testing:
- Added a SpnegoAuthTest which simulates 'knox' like proxy client and
uses SPNEGO to connect to Impala and also uses authentication cookies.
The test runs concurrent sql clients similar to real world scenarios.
Without the fix the test fails with error:
The user authorized on the connection '<username>' does not match the
session username ''
Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
---
M be/src/service/impala-hs2-server.cc
M fe/src/test/java/org/apache/impala/customcluster/KerberosKdcEnvironment.java
A fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java
A fe/src/test/java/org/apache/impala/customcluster/SpnegoTokenGenerator.java
A fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java
5 files changed, 900 insertions(+), 0 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/86/22986/1
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 1
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 9: Verified-1
Build failed: https://jenkins.impala.io/job/gerrit-verify-dryrun/12029/
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 9
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
Gerrit-Comment-Date: Sat, 14 Jun 2025 06:28:53 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Abhishek Rawat (Code Review)" <ge...@cloudera.org>.
Abhishek Rawat has uploaded a new patch set (#3). ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
IMPALA-14083: Connected user and session user mismatch when cookie based
authentication is used with SPNEGO
IMPALA-11298 allowed comparing short user name for connected user and
session user to support proxy clients like Hue which could potentially
use different physical hosts for queries/requests from the same session.
When cookie based authentication is used, the 'kerberos_user_short' is
not set on the ConnectionContext and as a result 'connected_user_short'
is not set in SessionState. This can cause a mismatch when comparing
short user names from ConnectionContext and SessionState. This happens
because the original connection authenticated using SPNEGO will have
'kerberos_user_short' in the ConnectionContext, while the other
connections authenticated using cookies won't have 'kerberos_user_short'
set in the ConnectionContext.
This patch addresses this issue by setting 'kerberos_user_short' in
ConnectionContext, when using auth cookies generated post SPNEGO. This
information is retrieved from 'impala.auth' cookie itself, which now
also stores the 'a=<AUTH_MECHANISM>' in the cookie's value.
Testing:
- Added a SpnegoAuthTest which simulates 'knox' like proxy client and
uses SPNEGO to connect to Impala and also uses authentication cookies.
The test runs concurrent sql clients similar to real world scenarios.
Without the fix the test fails with error:
The user authorized on the connection '<username>' does not match the
session username ''
Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
---
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/util/webserver.cc
M be/src/util/webserver.h
M fe/src/test/java/org/apache/impala/customcluster/KerberosKdcEnvironment.java
A fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java
A fe/src/test/java/org/apache/impala/customcluster/SpnegoTokenGenerator.java
A fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java
9 files changed, 977 insertions(+), 26 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/86/22986/3
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 3
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 9:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/19489/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 9
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
Gerrit-Comment-Date: Sat, 14 Jun 2025 00:45:00 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Abhishek Rawat (Code Review)" <ge...@cloudera.org>.
Abhishek Rawat has uploaded a new patch set (#10). ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
IMPALA-14083: Connected user and session user mismatch when cookie based
authentication is used with SPNEGO
IMPALA-11298 allowed comparing short user name for connected user and
session user to support proxy clients like Hue which could potentially
use different physical hosts for queries/requests from the same session.
When cookie based authentication is used, the 'kerberos_user_short' is
not set on the ConnectionContext and as a result 'connected_user_short'
is not set in SessionState. This can cause a mismatch when comparing
short user names from ConnectionContext and SessionState. This happens
because the original connection authenticated using SPNEGO will have
'kerberos_user_short' in the ConnectionContext, while the other
connections authenticated using cookies won't have 'kerberos_user_short'
set in the ConnectionContext.
This patch addresses this issue by setting 'kerberos_user_short' in
ConnectionContext, when using auth cookies generated post SPNEGO. This
information is retrieved from 'impala.auth' cookie itself, which now
also stores the 'a=<AUTH_MECHANISM>' in the cookie's value.
Testing:
- Added a SpnegoAuthTest which simulates 'knox' like proxy client and
uses SPNEGO to connect to Impala and also uses authentication cookies.
The test runs concurrent sql clients similar to real world scenarios.
Without the fix the test fails with error:
The user authorized on the connection '<username>' does not match the
session username ''
Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
---
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/util/webserver-test.cc
M be/src/util/webserver.cc
M be/src/util/webserver.h
M fe/src/test/java/org/apache/impala/customcluster/KerberosKdcEnvironment.java
A fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java
A fe/src/test/java/org/apache/impala/customcluster/SpnegoTokenGenerator.java
A fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java
10 files changed, 1,023 insertions(+), 32 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/86/22986/10
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 10
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Jason Fehr (Code Review)" <ge...@cloudera.org>.
Jason Fehr has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 10: Code-Review+2
(1 comment)
http://gerrit.cloudera.org:8080/#/c/22986/10/fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java
File fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java:
http://gerrit.cloudera.org:8080/#/c/22986/10/fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java@102
PS10, Line 102: /* Not compatible with thrift 0.11.0 which is used when USE_APACHE_COMPONENTS=true.
> I would prefer to keep it to make it easier when upgrading thrift versions
Done
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 10
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
Gerrit-Comment-Date: Sun, 15 Jun 2025 01:44:14 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Abhishek Rawat (Code Review)" <ge...@cloudera.org>.
Abhishek Rawat has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 4:
(5 comments)
http://gerrit.cloudera.org:8080/#/c/22986/3/be/src/rpc/authentication.cc
File be/src/rpc/authentication.cc:
http://gerrit.cloudera.org:8080/#/c/22986/3/be/src/rpc/authentication.cc@672
PS3, Line 672: GetShortUsernameFromKerberosPrincipal
> Maybe add a logging here for the username and short name here like line 904
Added debug logs for logging username and kerberos_user_short.
GetShortUsernameFromKerberosPrincipal(username) should return 'username' if the 'username' is not kerberos principal. I think the 'username' cannot be empty because NegotiateAuth will fail and not generate a cookie.
https://github.com/apache/impala/blob/master/be/src/rpc/authentication.cc#L881
http://gerrit.cloudera.org:8080/#/c/22986/3/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java
File fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java:
http://gerrit.cloudera.org:8080/#/c/22986/3/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java@249
PS3, Line 249: assertNotNull(authMech);
> Nit: debugging line that should be removed.
Done
http://gerrit.cloudera.org:8080/#/c/22986/3/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java@401
PS3, Line 401: String[] authMech = cookieValueFields[4].trim().split("=");
> Since Impala expects the cookie value to be in a specific format, it would
Done
http://gerrit.cloudera.org:8080/#/c/22986/3/fe/src/test/java/org/apache/impala/customcluster/SpnegoTokenGenerator.java
File fe/src/test/java/org/apache/impala/customcluster/SpnegoTokenGenerator.java:
http://gerrit.cloudera.org:8080/#/c/22986/3/fe/src/test/java/org/apache/impala/customcluster/SpnegoTokenGenerator.java@24
PS3, Line 24:
> not used in the code
Remove the import.
http://gerrit.cloudera.org:8080/#/c/22986/3/fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java
File fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java:
http://gerrit.cloudera.org:8080/#/c/22986/3/fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java@77
PS3, Line 77: THttpClientWithHeaders
> I'm not in favor of adding "Test" to the class name since having that word
I'll probably keep the class name as 'THttpClientWithHeaders' for now.
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 4
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
Gerrit-Comment-Date: Wed, 11 Jun 2025 02:24:31 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Abhishek Rawat (Code Review)" <ge...@cloudera.org>.
Abhishek Rawat has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 7:
(1 comment)
http://gerrit.cloudera.org:8080/#/c/22986/7/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java
File fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java:
http://gerrit.cloudera.org:8080/#/c/22986/7/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java@156
PS7, Line 156: verifySuccess(closeResp.getStatus());
> This close RPC should be in a finally block.
Done
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 7
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
Gerrit-Comment-Date: Fri, 13 Jun 2025 00:00:09 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Csaba Ringhofer (Code Review)" <ge...@cloudera.org>.
Csaba Ringhofer has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 8: Code-Review+2
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 8
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
Gerrit-Comment-Date: Fri, 13 Jun 2025 07:20:53 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 8:
Build started: https://jenkins.impala.io/job/gerrit-verify-dryrun/12021/ DRY_RUN=false
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 8
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
Gerrit-Comment-Date: Fri, 13 Jun 2025 14:46:55 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 8: Verified-1
Build failed: https://jenkins.impala.io/job/gerrit-verify-dryrun/12021/
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 8
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
Gerrit-Comment-Date: Sat, 14 Jun 2025 00:10:06 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 8:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/19472/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 8
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
Gerrit-Comment-Date: Fri, 13 Jun 2025 00:26:51 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 3:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/19422/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 3
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Comment-Date: Mon, 09 Jun 2025 23:38:37 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Csaba Ringhofer (Code Review)" <ge...@cloudera.org>.
Csaba Ringhofer has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 1:
(2 comments)
http://gerrit.cloudera.org:8080/#/c/22986/1/be/src/service/impala-hs2-server.cc
File be/src/service/impala-hs2-server.cc:
http://gerrit.cloudera.org:8080/#/c/22986/1/be/src/service/impala-hs2-server.cc@374
PS1, Line 374: connection_context->server_name == HS2_HTTP_SERVER_NAME)
Can't we do this somewhere else, e.g. in CookieAuth? https://github.com/apache/impala/blob/d630d6f8af8cd86a845fc0415c99b8aa6608c28f/be/src/rpc/authentication.cc#L662
I don't know if anyone relies on the structure of Impala security cookies - if not, then it should be safe to store the original auth method used, so we could fill connection_context members based on that. Or just set kerberos_user_short in every case.
http://gerrit.cloudera.org:8080/#/c/22986/1/be/src/service/impala-hs2-server.cc@383
PS1, Line 383: threads
The threads being important here is strange to me. My understanding is that in Thrift each tcp connection has its dedicated thread, and hs2-http connections may or may not start a new tcp connection in a new RPC. So I think that the main question is not the thread but the connection.
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 1
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Comment-Date: Fri, 06 Jun 2025 15:59:08 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Abhishek Rawat (Code Review)" <ge...@cloudera.org>.
Abhishek Rawat has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 2:
(8 comments)
http://gerrit.cloudera.org:8080/#/c/22986/1/be/src/service/impala-hs2-server.cc
File be/src/service/impala-hs2-server.cc:
http://gerrit.cloudera.org:8080/#/c/22986/1/be/src/service/impala-hs2-server.cc@374
PS1, Line 374: connection_context->server_name == HS2_HTTP_SERVER_NAME)
> Can't we do this somewhere else, e.g. in CookieAuth? https://github.com/apa
Yes, setting 'connection_context->kerberos_user_short' in CookieAuth() is also an alternative. The only issue would be we will be setting it for every RPC and not just OpenSession, which is still okay I think since we anyways set 'connection_context->username' in every call to CookieAuth.
I will explore setting the original Auth Mechanism in the Cookie.
http://gerrit.cloudera.org:8080/#/c/22986/1/be/src/service/impala-hs2-server.cc@383
PS1, Line 383: threads
> The threads being important here is strange to me. My understanding is that
Each thread caches ConnectionContext as a thread local variable and the SessionState object is created based on the cached ConnectionContext. Here is an example:
Thread_A: New connection from proxy client using SPNEGO
Thread_B: New connection from proxy client using Auth Cookie
sessions created by Thread_A will have 'connected_user_short' populated in the SessionState object. Any future RPCs from this session can be serviced by either Thread_A or Thread_B.
sessions created by Thread_B will not have 'connected_user_short' populated in the SessionState object. If the RPCs from this session is serviced by the same thread i.e., Thread_B then all good. However, if some RPC gets serviced by Thread_A then there is a mismatch.
http://gerrit.cloudera.org:8080/#/c/22986/1/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java
File fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java:
http://gerrit.cloudera.org:8080/#/c/22986/1/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java@182
PS1, Line 182: interestin
> nit: interesting
Done
http://gerrit.cloudera.org:8080/#/c/22986/1/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java@206
PS1, Line 206: assertEquals(0, ret); // cluster should start up
> should be assertEquals(0, ret) since the assertEquals function's first para
Done
http://gerrit.cloudera.org:8080/#/c/22986/1/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java@222
PS1, Line 222: assertEquals(TStatusCode.ERROR_STATUS, openResp.getStatus().getStatusCode());
> should be assertEquals(TStatusCode.ERROR_STATUS, openResp.getStatus().getSt
Done
http://gerrit.cloudera.org:8080/#/c/22986/1/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java@238
PS1, Line 238: assertEquals(TStatusCode.SUCCESS_STATUS, openResp.getStatus().getStatusCode());
> should be assertEquals(TStatusCode.SUCCESS_STATUS, openResp.getStatus().get
Done
http://gerrit.cloudera.org:8080/#/c/22986/1/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java@250
PS1, Line 250: } else {
> even though it *shouldn't* happen, please consider adding an else here to f
Done
http://gerrit.cloudera.org:8080/#/c/22986/1/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java@319
PS1, Line 319: int exitCode = process.wai
> Should be assertEquals(0, exitCode)
Done
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 2
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Comment-Date: Fri, 06 Jun 2025 21:25:34 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Yida Wu (Code Review)" <ge...@cloudera.org>.
Yida Wu has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 3:
(3 comments)
http://gerrit.cloudera.org:8080/#/c/22986/3/be/src/rpc/authentication.cc
File be/src/rpc/authentication.cc:
http://gerrit.cloudera.org:8080/#/c/22986/3/be/src/rpc/authentication.cc@672
PS3, Line 672: GetShortUsernameFromKerberosPrincipal
Maybe add a logging here for the username and short name here like line 904? Do we need to check if GetShortUsernameFromKerberosPrincipal() returns empty string?
http://gerrit.cloudera.org:8080/#/c/22986/3/fe/src/test/java/org/apache/impala/customcluster/SpnegoTokenGenerator.java
File fe/src/test/java/org/apache/impala/customcluster/SpnegoTokenGenerator.java:
http://gerrit.cloudera.org:8080/#/c/22986/3/fe/src/test/java/org/apache/impala/customcluster/SpnegoTokenGenerator.java@24
PS3, Line 24: import java.util.Base64;
not used in the code
http://gerrit.cloudera.org:8080/#/c/22986/3/fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java
File fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java:
http://gerrit.cloudera.org:8080/#/c/22986/3/fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java@77
PS3, Line 77: THttpClientWithHeaders
This class seems only used in custom cluster tests, maybe rename it to TestTHttpClientWithHeaders or MockTHttpClientWithHeaders or CustomClusterTHttpClient?
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 3
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
Gerrit-Comment-Date: Tue, 10 Jun 2025 04:04:27 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 10:
Build started: https://jenkins.impala.io/job/gerrit-verify-dryrun/12030/ DRY_RUN=false
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 10
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
Gerrit-Comment-Date: Sat, 14 Jun 2025 16:07:35 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Abhishek Rawat (Code Review)" <ge...@cloudera.org>.
Abhishek Rawat has uploaded a new patch set (#4). ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
IMPALA-14083: Connected user and session user mismatch when cookie based
authentication is used with SPNEGO
IMPALA-11298 allowed comparing short user name for connected user and
session user to support proxy clients like Hue which could potentially
use different physical hosts for queries/requests from the same session.
When cookie based authentication is used, the 'kerberos_user_short' is
not set on the ConnectionContext and as a result 'connected_user_short'
is not set in SessionState. This can cause a mismatch when comparing
short user names from ConnectionContext and SessionState. This happens
because the original connection authenticated using SPNEGO will have
'kerberos_user_short' in the ConnectionContext, while the other
connections authenticated using cookies won't have 'kerberos_user_short'
set in the ConnectionContext.
This patch addresses this issue by setting 'kerberos_user_short' in
ConnectionContext, when using auth cookies generated post SPNEGO. This
information is retrieved from 'impala.auth' cookie itself, which now
also stores the 'a=<AUTH_MECHANISM>' in the cookie's value.
Testing:
- Added a SpnegoAuthTest which simulates 'knox' like proxy client and
uses SPNEGO to connect to Impala and also uses authentication cookies.
The test runs concurrent sql clients similar to real world scenarios.
Without the fix the test fails with error:
The user authorized on the connection '<username>' does not match the
session username ''
Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
---
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/util/webserver-test.cc
M be/src/util/webserver.cc
M be/src/util/webserver.h
M fe/src/test/java/org/apache/impala/customcluster/KerberosKdcEnvironment.java
A fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java
A fe/src/test/java/org/apache/impala/customcluster/SpnegoTokenGenerator.java
A fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java
10 files changed, 1,004 insertions(+), 32 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/86/22986/4
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 4
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 9:
Build started: https://jenkins.impala.io/job/gerrit-verify-dryrun/12029/ DRY_RUN=false
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 9
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
Gerrit-Comment-Date: Sat, 14 Jun 2025 00:22:52 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 10: Verified+1
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 10
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
Gerrit-Comment-Date: Sat, 14 Jun 2025 22:13:42 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Abhishek Rawat (Code Review)" <ge...@cloudera.org>.
Abhishek Rawat has uploaded a new patch set (#7). ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
IMPALA-14083: Connected user and session user mismatch when cookie based
authentication is used with SPNEGO
IMPALA-11298 allowed comparing short user name for connected user and
session user to support proxy clients like Hue which could potentially
use different physical hosts for queries/requests from the same session.
When cookie based authentication is used, the 'kerberos_user_short' is
not set on the ConnectionContext and as a result 'connected_user_short'
is not set in SessionState. This can cause a mismatch when comparing
short user names from ConnectionContext and SessionState. This happens
because the original connection authenticated using SPNEGO will have
'kerberos_user_short' in the ConnectionContext, while the other
connections authenticated using cookies won't have 'kerberos_user_short'
set in the ConnectionContext.
This patch addresses this issue by setting 'kerberos_user_short' in
ConnectionContext, when using auth cookies generated post SPNEGO. This
information is retrieved from 'impala.auth' cookie itself, which now
also stores the 'a=<AUTH_MECHANISM>' in the cookie's value.
Testing:
- Added a SpnegoAuthTest which simulates 'knox' like proxy client and
uses SPNEGO to connect to Impala and also uses authentication cookies.
The test runs concurrent sql clients similar to real world scenarios.
Without the fix the test fails with error:
The user authorized on the connection '<username>' does not match the
session username ''
Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
---
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/util/webserver-test.cc
M be/src/util/webserver.cc
M be/src/util/webserver.h
M fe/src/test/java/org/apache/impala/customcluster/KerberosKdcEnvironment.java
A fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java
A fe/src/test/java/org/apache/impala/customcluster/SpnegoTokenGenerator.java
A fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java
10 files changed, 1,016 insertions(+), 32 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/86/22986/7
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 7
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Abhishek Rawat (Code Review)" <ge...@cloudera.org>.
Abhishek Rawat has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 1:
(1 comment)
http://gerrit.cloudera.org:8080/#/c/22986/1/be/src/service/impala-hs2-server.cc
File be/src/service/impala-hs2-server.cc:
http://gerrit.cloudera.org:8080/#/c/22986/1/be/src/service/impala-hs2-server.cc@374
PS1, Line 374: connection_context->server_name == HS2_HTTP_SERVER_NAME)
> Yes, setting 'connection_context->kerberos_user_short' in CookieAuth() is a
Latest patch stores Auth Mechanism in cookie's value.
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 1
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Comment-Date: Mon, 09 Jun 2025 23:11:43 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Jason Fehr (Code Review)" <ge...@cloudera.org>.
Jason Fehr has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 7:
(1 comment)
http://gerrit.cloudera.org:8080/#/c/22986/7/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java
File fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java:
http://gerrit.cloudera.org:8080/#/c/22986/7/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java@156
PS7, Line 156: verifySuccess(closeResp.getStatus());
This close RPC should be in a finally block.
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 7
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
Gerrit-Comment-Date: Thu, 12 Jun 2025 22:46:38 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Abhishek Rawat (Code Review)" <ge...@cloudera.org>.
Abhishek Rawat has uploaded a new patch set (#8). ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
IMPALA-14083: Connected user and session user mismatch when cookie based
authentication is used with SPNEGO
IMPALA-11298 allowed comparing short user name for connected user and
session user to support proxy clients like Hue which could potentially
use different physical hosts for queries/requests from the same session.
When cookie based authentication is used, the 'kerberos_user_short' is
not set on the ConnectionContext and as a result 'connected_user_short'
is not set in SessionState. This can cause a mismatch when comparing
short user names from ConnectionContext and SessionState. This happens
because the original connection authenticated using SPNEGO will have
'kerberos_user_short' in the ConnectionContext, while the other
connections authenticated using cookies won't have 'kerberos_user_short'
set in the ConnectionContext.
This patch addresses this issue by setting 'kerberos_user_short' in
ConnectionContext, when using auth cookies generated post SPNEGO. This
information is retrieved from 'impala.auth' cookie itself, which now
also stores the 'a=<AUTH_MECHANISM>' in the cookie's value.
Testing:
- Added a SpnegoAuthTest which simulates 'knox' like proxy client and
uses SPNEGO to connect to Impala and also uses authentication cookies.
The test runs concurrent sql clients similar to real world scenarios.
Without the fix the test fails with error:
The user authorized on the connection '<username>' does not match the
session username ''
Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
---
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/util/webserver-test.cc
M be/src/util/webserver.cc
M be/src/util/webserver.h
M fe/src/test/java/org/apache/impala/customcluster/KerberosKdcEnvironment.java
A fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java
A fe/src/test/java/org/apache/impala/customcluster/SpnegoTokenGenerator.java
A fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java
10 files changed, 1,022 insertions(+), 32 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/86/22986/8
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 8
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Jason Fehr (Code Review)" <ge...@cloudera.org>.
Jason Fehr has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 6:
carry forward +2, only changes since patchset 5 were new comments
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 6
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
Gerrit-Comment-Date: Thu, 12 Jun 2025 18:15:36 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Jason Fehr (Code Review)" <ge...@cloudera.org>.
Jason Fehr has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 5: Code-Review+1
(2 comments)
http://gerrit.cloudera.org:8080/#/c/22986/4/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java
File fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java:
http://gerrit.cloudera.org:8080/#/c/22986/4/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java@399
PS4, Line 399: // cookie_value like u=Test4Ldap@myorg.com&t=549158755&r=1800557187&a=SPNEGO.
> There is also <base64signature>&<cookie_value>. Updated the comment.
Ah, thanks for the explanation.
http://gerrit.cloudera.org:8080/#/c/22986/4/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java@400
PS4, Line 400: String[] cookieValueFields = cookieFields[0].trim().split("&");
> Expanded the comment before L398
Done
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 5
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
Gerrit-Comment-Date: Wed, 11 Jun 2025 17:52:54 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Csaba Ringhofer (Code Review)" <ge...@cloudera.org>.
Csaba Ringhofer has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 5: Code-Review+2
(2 comments)
Upgrading to +2 after reading through the tests. Also left a few nit comments.
http://gerrit.cloudera.org:8080/#/c/22986/5/fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java
File fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java:
http://gerrit.cloudera.org:8080/#/c/22986/5/fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java@20
PS5, Line 20: // This code is copied from apache/thrift and modified to return
can you add the exact path?
http://gerrit.cloudera.org:8080/#/c/22986/5/fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java@414
PS5, Line 414: public Map<String, List<String>> getResponseHeaders() {
This is the new code, right? Can you mark it with a comment?
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 5
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
Gerrit-Comment-Date: Thu, 12 Jun 2025 13:37:28 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Abhishek Rawat (Code Review)" <ge...@cloudera.org>.
Abhishek Rawat has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 6:
(4 comments)
Rebased and addressed latest comments.
http://gerrit.cloudera.org:8080/#/c/22986/1/be/src/service/impala-hs2-server.cc
File be/src/service/impala-hs2-server.cc:
http://gerrit.cloudera.org:8080/#/c/22986/1/be/src/service/impala-hs2-server.cc@374
PS1, Line 374:
> Thanks, while this made the patch more verbose, I think that it is clearer
Agree.
http://gerrit.cloudera.org:8080/#/c/22986/5/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java
File fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java:
http://gerrit.cloudera.org:8080/#/c/22986/5/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java@305
PS5, Line 305: apparentl
> typo
Done
http://gerrit.cloudera.org:8080/#/c/22986/5/fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java
File fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java:
http://gerrit.cloudera.org:8080/#/c/22986/5/fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java@20
PS5, Line 20: // This code is copied from apache/thrift and modified to return
> can you add the exact path?
Done
http://gerrit.cloudera.org:8080/#/c/22986/5/fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java@414
PS5, Line 414: } catch (IOException iox) {
> This is the new code, right? Can you mark it with a comment?
Done
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 6
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
Gerrit-Comment-Date: Thu, 12 Jun 2025 18:14:12 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Abhishek Rawat (Code Review)" <ge...@cloudera.org>.
Abhishek Rawat has uploaded a new patch set (#9). ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
IMPALA-14083: Connected user and session user mismatch when cookie based
authentication is used with SPNEGO
IMPALA-11298 allowed comparing short user name for connected user and
session user to support proxy clients like Hue which could potentially
use different physical hosts for queries/requests from the same session.
When cookie based authentication is used, the 'kerberos_user_short' is
not set on the ConnectionContext and as a result 'connected_user_short'
is not set in SessionState. This can cause a mismatch when comparing
short user names from ConnectionContext and SessionState. This happens
because the original connection authenticated using SPNEGO will have
'kerberos_user_short' in the ConnectionContext, while the other
connections authenticated using cookies won't have 'kerberos_user_short'
set in the ConnectionContext.
This patch addresses this issue by setting 'kerberos_user_short' in
ConnectionContext, when using auth cookies generated post SPNEGO. This
information is retrieved from 'impala.auth' cookie itself, which now
also stores the 'a=<AUTH_MECHANISM>' in the cookie's value.
Testing:
- Added a SpnegoAuthTest which simulates 'knox' like proxy client and
uses SPNEGO to connect to Impala and also uses authentication cookies.
The test runs concurrent sql clients similar to real world scenarios.
Without the fix the test fails with error:
The user authorized on the connection '<username>' does not match the
session username ''
Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
---
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/util/webserver-test.cc
M be/src/util/webserver.cc
M be/src/util/webserver.h
M fe/src/test/java/org/apache/impala/customcluster/KerberosKdcEnvironment.java
A fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java
A fe/src/test/java/org/apache/impala/customcluster/SpnegoTokenGenerator.java
A fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java
10 files changed, 1,022 insertions(+), 32 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/86/22986/9
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 9
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Abhishek Rawat (Code Review)" <ge...@cloudera.org>.
Abhishek Rawat has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 9: Code-Review+2
Rebased to pick up latest fixes for GVO. Carry over +2.
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 9
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
Gerrit-Comment-Date: Sat, 14 Jun 2025 00:21:19 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Jason Fehr (Code Review)" <ge...@cloudera.org>.
Jason Fehr has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 1:
(6 comments)
http://gerrit.cloudera.org:8080/#/c/22986/1/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java
File fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java:
http://gerrit.cloudera.org:8080/#/c/22986/1/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java@182
PS1, Line 182: intersting
nit: interesting
http://gerrit.cloudera.org:8080/#/c/22986/1/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java@206
PS1, Line 206: assertEquals(ret, 0); // cluster should start up
should be assertEquals(0, ret) since the assertEquals function's first parameter is the expected value and the second parameter is the actual value.
http://gerrit.cloudera.org:8080/#/c/22986/1/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java@222
PS1, Line 222: assertEquals(openResp.getStatus().getStatusCode(), TStatusCode.ERROR_STATUS);
should be assertEquals(TStatusCode.ERROR_STATUS, openResp.getStatus().getStatusCode());
http://gerrit.cloudera.org:8080/#/c/22986/1/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java@238
PS1, Line 238: assertEquals(openResp.getStatus().getStatusCode(), TStatusCode.SUCCESS_STATUS);
should be assertEquals(TStatusCode.SUCCESS_STATUS, openResp.getStatus().getStatusCode());
http://gerrit.cloudera.org:8080/#/c/22986/1/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java@250
PS1, Line 250: }
even though it *shouldn't* happen, please consider adding an else here to fail the test faster:
} else {
fail("no cookies returned from Impala");
}
http://gerrit.cloudera.org:8080/#/c/22986/1/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java@319
PS1, Line 319: assertEquals(exitCode, 0);
Should be assertEquals(0, exitCode)
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 1
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Comment-Date: Fri, 06 Jun 2025 15:41:26 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Jason Fehr (Code Review)" <ge...@cloudera.org>.
Jason Fehr has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 4:
(4 comments)
http://gerrit.cloudera.org:8080/#/c/22986/3/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java
File fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java:
http://gerrit.cloudera.org:8080/#/c/22986/3/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java@249
PS3, Line 249: assertNotNull(authMech);
> Done
Done
http://gerrit.cloudera.org:8080/#/c/22986/3/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java@401
PS3, Line 401: String[] authMech = cookieValueFields[4].trim().split("=");
> Done
Done
http://gerrit.cloudera.org:8080/#/c/22986/4/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java
File fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java:
http://gerrit.cloudera.org:8080/#/c/22986/4/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java@399
PS4, Line 399: assertEquals(5, cookieValueFields.length);
I'm not understanding why the cookieValueFields length is expected to be 5. The cookie is generated with 4 key-value pairs each separated by the & character -- https://gerrit.cloudera.org/c/22986/4/be/src/rpc/authentication-util.cc#160
http://gerrit.cloudera.org:8080/#/c/22986/4/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java@400
PS4, Line 400: // Expect cookie_value u=Test4Ldap@myorg.com&t=549158755&r=1800557187&a=SPNEGO.
Nit: this comment would make more sense if it was above line 398.
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 4
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
Gerrit-Comment-Date: Wed, 11 Jun 2025 14:46:49 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 5:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/19442/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 5
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
Gerrit-Comment-Date: Wed, 11 Jun 2025 15:49:07 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Abhishek Rawat (Code Review)" <ge...@cloudera.org>.
Abhishek Rawat has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 4:
(2 comments)
http://gerrit.cloudera.org:8080/#/c/22986/4/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java
File fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java:
http://gerrit.cloudera.org:8080/#/c/22986/4/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java@399
PS4, Line 399: assertEquals(5, cookieValueFields.length);
> I'm not understanding why the cookieValueFields length is expected to be 5.
There is also <base64signature>&<cookie_value>. Updated the comment.
http://gerrit.cloudera.org:8080/#/c/22986/4/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java@400
PS4, Line 400: // Expect cookie_value u=Test4Ldap@myorg.com&t=549158755&r=1800557187&a=SPNEGO.
> Nit: this comment would make more sense if it was above line 398.
Expanded the comment before L398
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 4
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
Gerrit-Comment-Date: Wed, 11 Jun 2025 15:22:53 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Abhishek Rawat (Code Review)" <ge...@cloudera.org>.
Abhishek Rawat has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 7:
The new test SpnegoAuthTest.testImpersonation was keeping queries open and as a result was failing on some test runs due to lack of admission resources. The latest patch closes queries properly.
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 7
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
Gerrit-Comment-Date: Thu, 12 Jun 2025 21:46:48 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 7:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/19471/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 7
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
Gerrit-Comment-Date: Thu, 12 Jun 2025 22:12:25 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Jason Fehr (Code Review)" <ge...@cloudera.org>.
Jason Fehr has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 6: Code-Review+2
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 6
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
Gerrit-Comment-Date: Thu, 12 Jun 2025 18:15:10 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 6:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/19465/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 6
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
Gerrit-Comment-Date: Thu, 12 Jun 2025 18:40:36 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Jason Fehr (Code Review)" <ge...@cloudera.org>.
Jason Fehr has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 8: Code-Review+1
(1 comment)
http://gerrit.cloudera.org:8080/#/c/22986/7/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java
File fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java:
http://gerrit.cloudera.org:8080/#/c/22986/7/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java@156
PS7, Line 156: } finally {
> Done
Done
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 8
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
Gerrit-Comment-Date: Fri, 13 Jun 2025 15:19:08 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Jason Fehr (Code Review)" <ge...@cloudera.org>.
Jason Fehr has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 10:
(1 comment)
http://gerrit.cloudera.org:8080/#/c/22986/10/fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java
File fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java:
http://gerrit.cloudera.org:8080/#/c/22986/10/fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java@102
PS10, Line 102: /* Not compatible with thrift 0.11.0 which is used when USE_APACHE_COMPONENTS=true.
Should this code be deleted? Should the tests that use it be skipped when USE_APACHE_COMPONENTS=true?
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 10
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
Gerrit-Comment-Date: Sun, 15 Jun 2025 01:35:56 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Abhishek Rawat (Code Review)" <ge...@cloudera.org>.
Abhishek Rawat has submitted this change and it was merged. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
IMPALA-14083: Connected user and session user mismatch when cookie based
authentication is used with SPNEGO
IMPALA-11298 allowed comparing short user name for connected user and
session user to support proxy clients like Hue which could potentially
use different physical hosts for queries/requests from the same session.
When cookie based authentication is used, the 'kerberos_user_short' is
not set on the ConnectionContext and as a result 'connected_user_short'
is not set in SessionState. This can cause a mismatch when comparing
short user names from ConnectionContext and SessionState. This happens
because the original connection authenticated using SPNEGO will have
'kerberos_user_short' in the ConnectionContext, while the other
connections authenticated using cookies won't have 'kerberos_user_short'
set in the ConnectionContext.
This patch addresses this issue by setting 'kerberos_user_short' in
ConnectionContext, when using auth cookies generated post SPNEGO. This
information is retrieved from 'impala.auth' cookie itself, which now
also stores the 'a=<AUTH_MECHANISM>' in the cookie's value.
Testing:
- Added a SpnegoAuthTest which simulates 'knox' like proxy client and
uses SPNEGO to connect to Impala and also uses authentication cookies.
The test runs concurrent sql clients similar to real world scenarios.
Without the fix the test fails with error:
The user authorized on the connection '<username>' does not match the
session username ''
Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Reviewed-on: http://gerrit.cloudera.org:8080/22986
Tested-by: Impala Public Jenkins <im...@cloudera.com>
Reviewed-by: Jason Fehr <jf...@cloudera.com>
---
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/util/webserver-test.cc
M be/src/util/webserver.cc
M be/src/util/webserver.h
M fe/src/test/java/org/apache/impala/customcluster/KerberosKdcEnvironment.java
A fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java
A fe/src/test/java/org/apache/impala/customcluster/SpnegoTokenGenerator.java
A fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java
10 files changed, 1,023 insertions(+), 32 deletions(-)
Approvals:
Impala Public Jenkins: Verified
Jason Fehr: Looks good to me, approved
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: merged
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 11
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 2:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/19411/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 2
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Comment-Date: Fri, 06 Jun 2025 21:52:18 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 1:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/19401/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 1
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Fri, 06 Jun 2025 02:22:05 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Abhishek Rawat (Code Review)" <ge...@cloudera.org>.
Abhishek Rawat has uploaded a new patch set (#2). ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
IMPALA-14083: Connected user and session user mismatch when cookie based
authentication is used with SPNEGO
IMPALA-11298 allowed comparing short user name for connected user and
session user to support proxy clients like Hue which could potentially
use different physical hosts for queries/requests from the same session.
When cookie based authentication is used, the 'kerberos_user_short' is
not set on the ConnectionContext and as a result 'connected_user_short'
is not set in SessionState. This can cause a mismatch when comparing
short user names from ConnectionContext and SessionState. This happens
because the original connection authenticated using SPNEGO will have
'kerberos_user_short' in the ConnectionContext, while the other
connections authenticated using cookies won't have 'kerberos_user_short'
set in the ConnectionContext.
This patch addresses this issue by setting 'connected_user_short' in
SessionState, if it's not set and HTTP transport is used for
OpenSession.
Testing:
- Added a SpnegoAuthTest which simulates 'knox' like proxy client and
uses SPNEGO to connect to Impala and also uses authentication cookies.
The test runs concurrent sql clients similar to real world scenarios.
Without the fix the test fails with error:
The user authorized on the connection '<username>' does not match the
session username ''
Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
---
M be/src/service/impala-hs2-server.cc
M fe/src/test/java/org/apache/impala/customcluster/KerberosKdcEnvironment.java
A fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java
A fe/src/test/java/org/apache/impala/customcluster/SpnegoTokenGenerator.java
A fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java
5 files changed, 902 insertions(+), 0 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/86/22986/2
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 2
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Jason Fehr (Code Review)" <ge...@cloudera.org>.
Jason Fehr has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 3:
(3 comments)
http://gerrit.cloudera.org:8080/#/c/22986/3/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java
File fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java:
http://gerrit.cloudera.org:8080/#/c/22986/3/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java@249
PS3, Line 249: System.out.println("cookie " + cookie);
Nit: debugging line that should be removed.
http://gerrit.cloudera.org:8080/#/c/22986/3/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java@401
PS3, Line 401: String[] cookieValueFields = cookieFields[0].trim().split("&");
Since Impala expects the cookie value to be in a specific format, it would make the test assertions more robust to check a specific index:
// pseudocode
assertEquals(4, cookieValueFields.length)
String[] authMech = cookieValueFields[3].trim().split("=")
assertEquals(2, authMech.length)
assertEquals("a", authMech[0])
return authMech[1]
http://gerrit.cloudera.org:8080/#/c/22986/3/fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java
File fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java:
http://gerrit.cloudera.org:8080/#/c/22986/3/fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java@77
PS3, Line 77: THttpClientWithHeaders
> This class seems only used in custom cluster tests, maybe rename it to Test
I'm not in favor of adding "Test" to the class name since having that word in the class name indicates the class contains JUnit tests. To me, having this class in the "src/test/java" folder is enough to indicate this class supports tests. This class won't be available to main code since it's in the "src/test/java" folder.
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 3
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
Gerrit-Comment-Date: Tue, 10 Jun 2025 16:09:50 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 4:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/19432/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 4
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
Gerrit-Comment-Date: Wed, 11 Jun 2025 02:50:39 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Abhishek Rawat (Code Review)" <ge...@cloudera.org>.
Abhishek Rawat has uploaded a new patch set (#5). ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
IMPALA-14083: Connected user and session user mismatch when cookie based
authentication is used with SPNEGO
IMPALA-11298 allowed comparing short user name for connected user and
session user to support proxy clients like Hue which could potentially
use different physical hosts for queries/requests from the same session.
When cookie based authentication is used, the 'kerberos_user_short' is
not set on the ConnectionContext and as a result 'connected_user_short'
is not set in SessionState. This can cause a mismatch when comparing
short user names from ConnectionContext and SessionState. This happens
because the original connection authenticated using SPNEGO will have
'kerberos_user_short' in the ConnectionContext, while the other
connections authenticated using cookies won't have 'kerberos_user_short'
set in the ConnectionContext.
This patch addresses this issue by setting 'kerberos_user_short' in
ConnectionContext, when using auth cookies generated post SPNEGO. This
information is retrieved from 'impala.auth' cookie itself, which now
also stores the 'a=<AUTH_MECHANISM>' in the cookie's value.
Testing:
- Added a SpnegoAuthTest which simulates 'knox' like proxy client and
uses SPNEGO to connect to Impala and also uses authentication cookies.
The test runs concurrent sql clients similar to real world scenarios.
Without the fix the test fails with error:
The user authorized on the connection '<username>' does not match the
session username ''
Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
---
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/util/webserver-test.cc
M be/src/util/webserver.cc
M be/src/util/webserver.h
M fe/src/test/java/org/apache/impala/customcluster/KerberosKdcEnvironment.java
A fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java
A fe/src/test/java/org/apache/impala/customcluster/SpnegoTokenGenerator.java
A fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java
10 files changed, 1,005 insertions(+), 32 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/86/22986/5
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 5
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Csaba Ringhofer (Code Review)" <ge...@cloudera.org>.
Csaba Ringhofer has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 5: Code-Review+1
(2 comments)
The implementation looks good to me, though I haven't processed the tests completely.
http://gerrit.cloudera.org:8080/#/c/22986/1/be/src/service/impala-hs2-server.cc
File be/src/service/impala-hs2-server.cc:
http://gerrit.cloudera.org:8080/#/c/22986/1/be/src/service/impala-hs2-server.cc@374
PS1, Line 374:
> Latest patch stores Auth Mechanism in cookie's value.
Thanks, while this made the patch more verbose, I think that it is clearer like this.
http://gerrit.cloudera.org:8080/#/c/22986/5/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java
File fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java:
http://gerrit.cloudera.org:8080/#/c/22986/5/fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java@305
PS5, Line 305: apprently
typo
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 5
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
Gerrit-Comment-Date: Thu, 12 Jun 2025 08:08:27 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 6:
Build started: https://jenkins.impala.io/job/gerrit-verify-dryrun/12013/ DRY_RUN=false
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 6
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
Gerrit-Comment-Date: Thu, 12 Jun 2025 18:17:36 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Abhishek Rawat (Code Review)" <ge...@cloudera.org>.
Abhishek Rawat has uploaded a new patch set (#6). ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
IMPALA-14083: Connected user and session user mismatch when cookie based
authentication is used with SPNEGO
IMPALA-11298 allowed comparing short user name for connected user and
session user to support proxy clients like Hue which could potentially
use different physical hosts for queries/requests from the same session.
When cookie based authentication is used, the 'kerberos_user_short' is
not set on the ConnectionContext and as a result 'connected_user_short'
is not set in SessionState. This can cause a mismatch when comparing
short user names from ConnectionContext and SessionState. This happens
because the original connection authenticated using SPNEGO will have
'kerberos_user_short' in the ConnectionContext, while the other
connections authenticated using cookies won't have 'kerberos_user_short'
set in the ConnectionContext.
This patch addresses this issue by setting 'kerberos_user_short' in
ConnectionContext, when using auth cookies generated post SPNEGO. This
information is retrieved from 'impala.auth' cookie itself, which now
also stores the 'a=<AUTH_MECHANISM>' in the cookie's value.
Testing:
- Added a SpnegoAuthTest which simulates 'knox' like proxy client and
uses SPNEGO to connect to Impala and also uses authentication cookies.
The test runs concurrent sql clients similar to real world scenarios.
Without the fix the test fails with error:
The user authorized on the connection '<username>' does not match the
session username ''
Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
---
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/util/webserver-test.cc
M be/src/util/webserver.cc
M be/src/util/webserver.h
M fe/src/test/java/org/apache/impala/customcluster/KerberosKdcEnvironment.java
A fe/src/test/java/org/apache/impala/customcluster/SpnegoAuthTest.java
A fe/src/test/java/org/apache/impala/customcluster/SpnegoTokenGenerator.java
A fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java
10 files changed, 1,014 insertions(+), 32 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/86/22986/6
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 6
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 10:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/19491/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 10
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
Gerrit-Comment-Date: Sat, 14 Jun 2025 16:32:02 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
Posted by "Abhishek Rawat (Code Review)" <ge...@cloudera.org>.
Abhishek Rawat has posted comments on this change. ( http://gerrit.cloudera.org:8080/22986 )
Change subject: IMPALA-14083: Connected user and session user mismatch when cookie based authentication is used with SPNEGO
......................................................................
Patch Set 10:
(1 comment)
http://gerrit.cloudera.org:8080/#/c/22986/10/fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java
File fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java:
http://gerrit.cloudera.org:8080/#/c/22986/10/fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java@102
PS10, Line 102: /* Not compatible with thrift 0.11.0 which is used when USE_APACHE_COMPONENTS=true.
> Should this code be deleted? Should the tests that use it be skipped when
I would prefer to keep it to make it easier when upgrading thrift versions or this file in future.
--
To view, visit http://gerrit.cloudera.org:8080/22986
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Id7223e449c32484bfd2295f7a9e728b7c02637e9
Gerrit-Change-Number: 22986
Gerrit-PatchSet: 10
Gerrit-Owner: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Yida Wu <wy...@gmail.com>
Gerrit-Comment-Date: Sun, 15 Jun 2025 01:40:25 +0000
Gerrit-HasComments: Yes