You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@impala.apache.org by "Thomas Tauber-Marshall (JIRA)" <ji...@apache.org> on 2019/07/23 16:37:00 UTC
[jira] [Resolved] (IMPALA-5278) Add Kerberos HTTP SPNEGO
authentication support to Impala web consoles
[ https://issues.apache.org/jira/browse/IMPALA-5278?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Thomas Tauber-Marshall resolved IMPALA-5278.
--------------------------------------------
Resolution: Fixed
Fix Version/s: Impala 3.3.0
commit 9f0cd9743a9c364d1eb42f29f67494298ed574ae
Author: Todd Lipcon <to...@apache.org>
Date: Mon Jul 1 16:59:24 2019 -0700
Support SPNEGO for Impala webserver
This ports over changes from kudu commit
1f291b77ef0868ac888a850678adc2d7cce65529 which implemented SPNEGO for
the Kudu webserver.
Unfortunately, thorough testing of this is difficult given that curl
isn't currently in the toolchain. I was able to manually test this by
adding a 'sleep(1000)' call into the newly added test case, then setting
up $KRB5_CONFIG in my shell to point to the temporary KDC's environment,
and using 'curl -u : --negotiate http://...' to authenticate.
Strangely, using the version of curl on el7 didn't seem to work properly
(perhaps an el7 curl bug) but using curl on my Ubuntu 18 laptop I was
able to authenticate with SPNEGO.
Change-Id: Ife2b04310e1571d231bf8ee1bcfd3b7afc2edd8f
Reviewed-on: http://gerrit.cloudera.org:8080/13774
Reviewed-by: Impala Public Jenkins <im...@cloudera.com>
Tested-by: Impala Public Jenkins <im...@cloudera.com>
> Add Kerberos HTTP SPNEGO authentication support to Impala web consoles
> ----------------------------------------------------------------------
>
> Key: IMPALA-5278
> URL: https://issues.apache.org/jira/browse/IMPALA-5278
> Project: IMPALA
> Issue Type: Improvement
> Components: Catalog, Clients
> Reporter: Chris A
> Priority: Major
> Labels: kerberos, security, spnego, web-console, web-ui
> Fix For: Impala 3.3.0
>
>
> https://issues.apache.org/jira/browse/HADOOP-7119 and https://issues.apache.org/jira/browse/HBASE-5291 show SPNEGO being added to web consoles and web UIs to provide security through Kerberos (as a single sign-on solution)
> According to current documentation (https://www.cloudera.com/documentation/enterprise/5-5-x/topics/impala_kerberos.html), Kerberos HTTP SPNEGO is not supported in Impala's Web UIs. Is there a way to implement this in the Impala WebUIs?
--
This message was sent by Atlassian JIRA
(v7.6.14#76016)