You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@kyuubi.apache.org by "cs-lpc (via GitHub)" <gi...@apache.org> on 2023/09/01 03:11:40 UTC
[GitHub] [kyuubi] cs-lpc opened a new issue, #5230: [Bug] https://github.com/apache/spark/pull/42760
cs-lpc opened a new issue, #5230:
URL: https://github.com/apache/kyuubi/issues/5230
### Code of Conduct
- [X] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)
### Search before asking
- [X] I have searched in the [issues](https://github.com/apache/kyuubi/issues?q=is%3Aissue) and found no similar issues.
### Describe the bug
According to the PR https://github.com/apache/spark/pull/42760, if the hive.metastore.token.signature parameter is not empty, we may also encounter authentication failures in Kyuubi.
1. Set the configuration bellow
```
<property>
<name>hive.metastore.token.signature</name>
<value>HIVE_DELEGATION_TOKEN</value>
</property>
```
3. Start kyuubi server with `hive`
4. Connet kyuubi with proxy user ，
5. Run sql `insert into test11 values('a');`
then the user will be `hive` to execute hdfs command
### Affects Version(s)
master
### Kyuubi Server Log Output
_No response_
### Kyuubi Engine Log Output
_No response_
### Kyuubi Server Configurations
```yaml
<property>
<name>hive.metastore.token.signature</name>
<value>HIVE_DELEGATION_TOKEN</value>
</property>
```
### Kyuubi Engine Configurations
_No response_
### Additional context
_No response_
### Are you willing to submit PR?
- [X] Yes. I would be willing to submit a PR with guidance from the Kyuubi community to fix.
- [ ] No. I cannot submit a PR at this time.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org
[GitHub] [kyuubi] cxzl25 commented on issue #5230: [Bug] kyuubi using --proxy-user GSS init failed when hive.metastore.token.signature not empty
Posted by "cxzl25 (via GitHub)" <gi...@apache.org>.
cxzl25 commented on issue #5230:
URL: https://github.com/apache/kyuubi/issues/5230#issuecomment-1702173697
It sounds like a misconfiguration, `hive.metastore.token.signature` should not be configured in `hive-site.xml`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org
[GitHub] [kyuubi] cs-lpc commented on issue #5230: [Bug] kyuubi using --proxy-user GSS init failed when hive.metastore.token.signature not empty
Posted by "cs-lpc (via GitHub)" <gi...@apache.org>.
cs-lpc commented on issue #5230:
URL: https://github.com/apache/kyuubi/issues/5230#issuecomment-1702120275
After merging https://github.com/apache/spark/pull/42760, directly overwriting this configuration may cause new exceptions. We need to be provied new configuration. By adjusting the default value of this configuration can adapt to different versions of Spark.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org
[GitHub] [kyuubi] zzzzming95 commented on issue #5230: [Bug] kyuubi using --proxy-user GSS init failed when hive.metastore.token.signature not empty
Posted by "zzzzming95 (via GitHub)" <gi...@apache.org>.
zzzzming95 commented on issue #5230:
URL: https://github.com/apache/kyuubi/issues/5230#issuecomment-1707561259
> It sounds like a misconfiguration, `hive.metastore.token.signature` should not be configured in `hive-site.xml`.
`hive.metastore.token.signature` mean the namespace of the metastore token, the default value is empty. In hiveserver, they hardcode this conf's value.
https://github.com/apache/hive/blob/0fdf143cf775ccf909e092fda2eaef443e68fa23/service/src/java/org/apache/hive/service/auth/HiveAuthConstants.java#L44
But in some case we need to conf the configuration `hive.metastore.token.signature` in `hive-site.xml`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org
[GitHub] [kyuubi] pan3793 commented on issue #5230: [Bug] kyuubi using --proxy-user GSS init failed when hive.metastore.token.signature not empty
Posted by "pan3793 (via GitHub)" <gi...@apache.org>.
pan3793 commented on issue #5230:
URL: https://github.com/apache/kyuubi/issues/5230#issuecomment-1702096386
Do you have suggestions? Maybe forcibly overwriting `hive.metastore.token.signature` during `spark-submit`?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org
[GitHub] [kyuubi] cs-lpc commented on issue #5230: [Bug] kyuubi using --proxy-user GSS init failed when hive.metastore.token.signature not empty
Posted by "cs-lpc (via GitHub)" <gi...@apache.org>.
cs-lpc commented on issue #5230:
URL: https://github.com/apache/kyuubi/issues/5230#issuecomment-1702094734
Before Spark fixes this bug, Kyuubi should also be compatible with this behavior.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org
[GitHub] [kyuubi] cs-lpc commented on issue #5230: [Bug] kyuubi using --proxy-user GSS init failed when hive.metastore.token.signature not empty
Posted by "cs-lpc (via GitHub)" <gi...@apache.org>.
cs-lpc commented on issue #5230:
URL: https://github.com/apache/kyuubi/issues/5230#issuecomment-1709425985
https://github.com/apache/kyuubi/pull/5261
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org
[GitHub] [kyuubi] pan3793 commented on issue #5230: [Bug] kyuubi using --proxy-user GSS init failed when hive.metastore.token.signature not empty
Posted by "pan3793 (via GitHub)" <gi...@apache.org>.
pan3793 commented on issue #5230:
URL: https://github.com/apache/kyuubi/issues/5230#issuecomment-1702122532
Yes, the overwriting behavior should be judged by the Spark version and also allowed to be disabled in case some vendor's Spark version backports it into lower Spark versions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org
[GitHub] [kyuubi] pan3793 commented on issue #5230: [Bug] kyuubi using --proxy-user GSS init failed when hive.metastore.token.signature not empty
Posted by "pan3793 (via GitHub)" <gi...@apache.org>.
pan3793 commented on issue #5230:
URL: https://github.com/apache/kyuubi/issues/5230#issuecomment-1702104421
cc @zhouyifan279
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org