You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@hive.apache.org by Arup Malakar <am...@gmail.com> on 2013/07/22 22:56:04 UTC
Review Request 12824: [HIVE-4911] Enable QOP configuration for Hive Server 2
thrift transport
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/12824/
-----------------------------------------------------------
Review request for hive.
Bugs: HIVE-4911
https://issues.apache.org/jira/browse/HIVE-4911
Repository: hive-git
Description
-------
The QoP for hive server 2 should be configurable to enable encryption. A new configuration should be exposed "hive.server2.thrift.rpc.protection". This would give greater control configuring hive server 2 service.
Diffs
-----
common/src/java/org/apache/hadoop/hive/conf/HiveConf.java 11c31216495d0c4e454f2627af5c93a9f270b1fe
data/conf/hive-site.xml 4e6ff16135833da1a4df12a12a6fe59ad4f870ba
jdbc/src/java/org/apache/hive/jdbc/HiveConnection.java 00f43511b478c687b7811fc8ad66af2b507a3626
service/src/java/org/apache/hive/service/auth/HiveAuthFactory.java 1809e1b26ceee5de14a354a0e499aa8c0ab793bf
service/src/java/org/apache/hive/service/auth/KerberosSaslHelper.java 379dafb8377aed55e74f0ae18407996bb9e1216f
service/src/java/org/apache/hive/service/auth/SaslQOP.java PRE-CREATION
shims/src/common-secure/java/org/apache/hadoop/hive/thrift/HadoopThriftAuthBridge20S.java 777226f8da0af2235d4294cd6a676fa8192c89e4
shims/src/common/java/org/apache/hadoop/hive/thrift/HadoopThriftAuthBridge.java 9b0ec0a75563b41339e6fc747556440fdf83e31e
Diff: https://reviews.apache.org/r/12824/diff/
Testing
-------
Thanks,
Arup Malakar
Re: Review Request 12824: [HIVE-4911] Enable QOP configuration for Hive
Server 2 thrift transport
Posted by Arup Malakar <am...@gmail.com>.
> On July 23, 2013, 9:54 p.m., Thejas Nair wrote:
> > common/src/java/org/apache/hadoop/hive/conf/HiveConf.java, line 728
> > <https://reviews.apache.org/r/12824/diff/1/?file=324967#file324967line728>
> >
> > should we just call this
> > hive.server2.thrift.sasl.qop ? That seems more self describing.
> >
I derived the name from "hadoop.rpc.protection", but I totally agree that hadoop.rpc.protection itself was a bit of misnomer. And using sasl.qop is self-describing and people can easily relate this to auth, auth-int, auth-conf etc.
- Arup
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/12824/#review23722
-----------------------------------------------------------
On July 24, 2013, 4:43 p.m., Arup Malakar wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/12824/
> -----------------------------------------------------------
>
> (Updated July 24, 2013, 4:43 p.m.)
>
>
> Review request for hive.
>
>
> Bugs: HIVE-4911
> https://issues.apache.org/jira/browse/HIVE-4911
>
>
> Repository: hive-git
>
>
> Description
> -------
>
> The QoP for hive server 2 should be configurable to enable encryption. A new configuration should be exposed "hive.server2.thrift.rpc.protection". This would give greater control configuring hive server 2 service.
>
>
> Diffs
> -----
>
> common/src/java/org/apache/hadoop/hive/conf/HiveConf.java 11c31216495d0c4e454f2627af5c93a9f270b1fe
> conf/hive-default.xml.template 603b475802152a4bd5ab92a4c7146b56f6be020d
> jdbc/src/java/org/apache/hive/jdbc/HiveConnection.java 00f43511b478c687b7811fc8ad66af2b507a3626
> metastore/src/java/org/apache/hadoop/hive/metastore/HiveMetaStore.java 72eac989394a3899998e52d3845b02bb38ebeaad
> metastore/src/java/org/apache/hadoop/hive/metastore/HiveMetaStoreClient.java cef50f40ccb047a8135f704b2997968a2cf477b8
> metastore/src/java/org/apache/hadoop/hive/metastore/MetaStoreUtils.java 88151a1d48b12cf3a8346ae94b6d1a182a331992
> service/src/java/org/apache/hive/service/auth/HiveAuthFactory.java 1809e1b26ceee5de14a354a0e499aa8c0ab793bf
> service/src/java/org/apache/hive/service/auth/KerberosSaslHelper.java 379dafb8377aed55e74f0ae18407996bb9e1216f
> service/src/java/org/apache/hive/service/auth/SaslQOP.java PRE-CREATION
> shims/src/common-secure/java/org/apache/hadoop/hive/thrift/HadoopThriftAuthBridge20S.java 777226f8da0af2235d4294cd6a676fa8192c89e4
> shims/src/common/java/org/apache/hadoop/hive/thrift/HadoopThriftAuthBridge.java 9b0ec0a75563b41339e6fc747556440fdf83e31e
>
> Diff: https://reviews.apache.org/r/12824/diff/
>
>
> Testing
> -------
>
>
> Thanks,
>
> Arup Malakar
>
>
Re: Review Request 12824: [HIVE-4911] Enable QOP configuration for Hive
Server 2 thrift transport
Posted by Thejas Nair <th...@hortonworks.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/12824/#review23722
-----------------------------------------------------------
common/src/java/org/apache/hadoop/hive/conf/HiveConf.java
<https://reviews.apache.org/r/12824/#comment47598>
should we just call this
hive.server2.thrift.sasl.qop ? That seems more self describing.
- Thejas Nair
On July 22, 2013, 8:56 p.m., Arup Malakar wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/12824/
> -----------------------------------------------------------
>
> (Updated July 22, 2013, 8:56 p.m.)
>
>
> Review request for hive.
>
>
> Bugs: HIVE-4911
> https://issues.apache.org/jira/browse/HIVE-4911
>
>
> Repository: hive-git
>
>
> Description
> -------
>
> The QoP for hive server 2 should be configurable to enable encryption. A new configuration should be exposed "hive.server2.thrift.rpc.protection". This would give greater control configuring hive server 2 service.
>
>
> Diffs
> -----
>
> common/src/java/org/apache/hadoop/hive/conf/HiveConf.java 11c31216495d0c4e454f2627af5c93a9f270b1fe
> data/conf/hive-site.xml 4e6ff16135833da1a4df12a12a6fe59ad4f870ba
> jdbc/src/java/org/apache/hive/jdbc/HiveConnection.java 00f43511b478c687b7811fc8ad66af2b507a3626
> service/src/java/org/apache/hive/service/auth/HiveAuthFactory.java 1809e1b26ceee5de14a354a0e499aa8c0ab793bf
> service/src/java/org/apache/hive/service/auth/KerberosSaslHelper.java 379dafb8377aed55e74f0ae18407996bb9e1216f
> service/src/java/org/apache/hive/service/auth/SaslQOP.java PRE-CREATION
> shims/src/common-secure/java/org/apache/hadoop/hive/thrift/HadoopThriftAuthBridge20S.java 777226f8da0af2235d4294cd6a676fa8192c89e4
> shims/src/common/java/org/apache/hadoop/hive/thrift/HadoopThriftAuthBridge.java 9b0ec0a75563b41339e6fc747556440fdf83e31e
>
> Diff: https://reviews.apache.org/r/12824/diff/
>
>
> Testing
> -------
>
>
> Thanks,
>
> Arup Malakar
>
>
Re: Review Request 12824: [HIVE-4911] Enable QOP configuration for Hive
Server 2 thrift transport
Posted by Thejas Nair <th...@hortonworks.com>.
> On July 23, 2013, 9:48 p.m., Thejas Nair wrote:
> > jdbc/src/java/org/apache/hive/jdbc/HiveConnection.java, line 142
> > <https://reviews.apache.org/r/12824/diff/1/?file=324969#file324969line142>
> >
> > the HIVE_AUTH_TYPE env variable is called "auth".
> > Should we use something more descriptive like "sasl.qop" as the variable that sets the QOP level.
> >
>
> Arup Malakar wrote:
> I am totally agree that a different key name should be used for qop settings. As the current HIVE_AUTH_TYPE configuration key is overloaded. Original idea was to clean up the configuration keys which is being taken care of in: https://issues.apache.org/jira/browse/HIVE-4232. Once the auth params are taken care of, I had plans of introducing a new parameter called qop which would be used to configure the QoP alone. But since HIVE-4232 is not yet committed, I ended up using the HIVE_AUTH_TYPE. I can rebase if HIVE-4232 goes in.
>
> Arup Malakar wrote:
> I am totally agree that a different key name should be used for qop settings. As the current HIVE_AUTH_TYPE configuration key is overloaded. Original idea was to clean up the configuration keys which is being taken care of in: https://issues.apache.org/jira/browse/HIVE-4232. Once the auth params are taken care of, I had plans of introducing a new parameter called qop which would be used to configure the QoP alone. But since HIVE-4232 is not yet committed, I ended up using the HIVE_AUTH_TYPE. I can rebase if HIVE-4232 goes in.
Once this becomes part of a release, we would need to worry about backward compatibility. ie, we would need to continue to support "auth=auth" , "auth=auth-int" etc .
I think using sasl.qop as parameter name instead would makes sense with or without HIVE-4232 changes.
- Thejas
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/12824/#review23711
-----------------------------------------------------------
On July 24, 2013, 4:43 p.m., Arup Malakar wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/12824/
> -----------------------------------------------------------
>
> (Updated July 24, 2013, 4:43 p.m.)
>
>
> Review request for hive.
>
>
> Bugs: HIVE-4911
> https://issues.apache.org/jira/browse/HIVE-4911
>
>
> Repository: hive-git
>
>
> Description
> -------
>
> The QoP for hive server 2 should be configurable to enable encryption. A new configuration should be exposed "hive.server2.thrift.rpc.protection". This would give greater control configuring hive server 2 service.
>
>
> Diffs
> -----
>
> common/src/java/org/apache/hadoop/hive/conf/HiveConf.java 11c31216495d0c4e454f2627af5c93a9f270b1fe
> conf/hive-default.xml.template 603b475802152a4bd5ab92a4c7146b56f6be020d
> jdbc/src/java/org/apache/hive/jdbc/HiveConnection.java 00f43511b478c687b7811fc8ad66af2b507a3626
> metastore/src/java/org/apache/hadoop/hive/metastore/HiveMetaStore.java 72eac989394a3899998e52d3845b02bb38ebeaad
> metastore/src/java/org/apache/hadoop/hive/metastore/HiveMetaStoreClient.java cef50f40ccb047a8135f704b2997968a2cf477b8
> metastore/src/java/org/apache/hadoop/hive/metastore/MetaStoreUtils.java 88151a1d48b12cf3a8346ae94b6d1a182a331992
> service/src/java/org/apache/hive/service/auth/HiveAuthFactory.java 1809e1b26ceee5de14a354a0e499aa8c0ab793bf
> service/src/java/org/apache/hive/service/auth/KerberosSaslHelper.java 379dafb8377aed55e74f0ae18407996bb9e1216f
> service/src/java/org/apache/hive/service/auth/SaslQOP.java PRE-CREATION
> shims/src/common-secure/java/org/apache/hadoop/hive/thrift/HadoopThriftAuthBridge20S.java 777226f8da0af2235d4294cd6a676fa8192c89e4
> shims/src/common/java/org/apache/hadoop/hive/thrift/HadoopThriftAuthBridge.java 9b0ec0a75563b41339e6fc747556440fdf83e31e
>
> Diff: https://reviews.apache.org/r/12824/diff/
>
>
> Testing
> -------
>
>
> Thanks,
>
> Arup Malakar
>
>
Re: Review Request 12824: [HIVE-4911] Enable QOP configuration for Hive
Server 2 thrift transport
Posted by Arup Malakar <am...@gmail.com>.
> On July 23, 2013, 9:48 p.m., Thejas Nair wrote:
> > jdbc/src/java/org/apache/hive/jdbc/HiveConnection.java, line 142
> > <https://reviews.apache.org/r/12824/diff/1/?file=324969#file324969line142>
> >
> > the HIVE_AUTH_TYPE env variable is called "auth".
> > Should we use something more descriptive like "sasl.qop" as the variable that sets the QOP level.
> >
>
> Arup Malakar wrote:
> I am totally agree that a different key name should be used for qop settings. As the current HIVE_AUTH_TYPE configuration key is overloaded. Original idea was to clean up the configuration keys which is being taken care of in: https://issues.apache.org/jira/browse/HIVE-4232. Once the auth params are taken care of, I had plans of introducing a new parameter called qop which would be used to configure the QoP alone. But since HIVE-4232 is not yet committed, I ended up using the HIVE_AUTH_TYPE. I can rebase if HIVE-4232 goes in.
I am totally agree that a different key name should be used for qop settings. As the current HIVE_AUTH_TYPE configuration key is overloaded. Original idea was to clean up the configuration keys which is being taken care of in: https://issues.apache.org/jira/browse/HIVE-4232. Once the auth params are taken care of, I had plans of introducing a new parameter called qop which would be used to configure the QoP alone. But since HIVE-4232 is not yet committed, I ended up using the HIVE_AUTH_TYPE. I can rebase if HIVE-4232 goes in.
> On July 23, 2013, 9:48 p.m., Thejas Nair wrote:
> > jdbc/src/java/org/apache/hive/jdbc/HiveConnection.java, line 142
> > <https://reviews.apache.org/r/12824/diff/1/?file=324969#file324969line142>
> >
> > the HIVE_AUTH_TYPE env variable is called "auth".
> > Should we use something more descriptive like "sasl.qop" as the variable that sets the QOP level.
> >
>
> Arup Malakar wrote:
> I am totally agree that a different key name should be used for qop settings. As the current HIVE_AUTH_TYPE configuration key is overloaded. Original idea was to clean up the configuration keys which is being taken care of in: https://issues.apache.org/jira/browse/HIVE-4232. Once the auth params are taken care of, I had plans of introducing a new parameter called qop which would be used to configure the QoP alone. But since HIVE-4232 is not yet committed, I ended up using the HIVE_AUTH_TYPE. I can rebase if HIVE-4232 goes in.
I am totally agree that a different key name should be used for qop settings. As the current HIVE_AUTH_TYPE configuration key is overloaded. Original idea was to clean up the configuration keys which is being taken care of in: https://issues.apache.org/jira/browse/HIVE-4232. Once the auth params are taken care of, I had plans of introducing a new parameter called qop which would be used to configure the QoP alone. But since HIVE-4232 is not yet committed, I ended up using the HIVE_AUTH_TYPE. I can rebase if HIVE-4232 goes in.
> On July 23, 2013, 9:48 p.m., Thejas Nair wrote:
> > shims/src/common-secure/java/org/apache/hadoop/hive/thrift/HadoopThriftAuthBridge20S.java, line 111
> > <https://reviews.apache.org/r/12824/diff/1/?file=324973#file324973line111>
> >
> > This function is called from hive metastore client. Using SaslRpcServer.SASL_PROPS here means that setting hadoop.rpc.protection will determine the QOP level, if we make a call to SaslRpcServer.init(conf) from anywhere in the code. But that function is not being called.
> >
> > I think it makes sense to use hadoop.rpc.protection for metastore QOP, since metastore usually not exposed 'outside' the cluster unlike hive server2. It is often viewed as something 'inside the cluster'.
> >
> > Should we change this function to take in a configuration object and use that to call SaslRpcServer.init(conf) ?
The current createClientTransport method (without this patch) uses SaslRpcServer.SASL_PROPS too, but it doesn't call SaslRpcServer.init(conf) so I assumed SaslRpcServer.init(conf) is being called before reaching this method. But looking at https://issues.apache.org/jira/browse/HIVE-4232 I realized that this is indeed a bug in current code.
Rather than doing init() in createTransportFactory() and createClientTransport() I removed the default method that uses SaslRpcServer.SASL_PROPS. Both these methods now only takes Map<String, String>. In case of both metastore client/server the code gets the Sasl propeties from MetaStoreUtils.getMetaStoreSaslProperties(conf) and passes it to the methods in HadoopThriftAuthBridge20S.
Reasons:
1. We could remove the redundant methods that defaults to SaslRpcServer.SASL_PROPS
2. Changing meta store to use different configuration can be easily accomplished by modifying in only one place MetaStoreUtils.getMetaStoreSaslProperties(conf)
Let me know what you think of it.
I have a question though, is it okay to access SaslRpcSercer.SASL_PROPS from MetaStoreUtils class, I mean compiling with hadoop 20 wise?
- Arup
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/12824/#review23711
-----------------------------------------------------------
On July 24, 2013, 4:43 p.m., Arup Malakar wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/12824/
> -----------------------------------------------------------
>
> (Updated July 24, 2013, 4:43 p.m.)
>
>
> Review request for hive.
>
>
> Bugs: HIVE-4911
> https://issues.apache.org/jira/browse/HIVE-4911
>
>
> Repository: hive-git
>
>
> Description
> -------
>
> The QoP for hive server 2 should be configurable to enable encryption. A new configuration should be exposed "hive.server2.thrift.rpc.protection". This would give greater control configuring hive server 2 service.
>
>
> Diffs
> -----
>
> common/src/java/org/apache/hadoop/hive/conf/HiveConf.java 11c31216495d0c4e454f2627af5c93a9f270b1fe
> conf/hive-default.xml.template 603b475802152a4bd5ab92a4c7146b56f6be020d
> jdbc/src/java/org/apache/hive/jdbc/HiveConnection.java 00f43511b478c687b7811fc8ad66af2b507a3626
> metastore/src/java/org/apache/hadoop/hive/metastore/HiveMetaStore.java 72eac989394a3899998e52d3845b02bb38ebeaad
> metastore/src/java/org/apache/hadoop/hive/metastore/HiveMetaStoreClient.java cef50f40ccb047a8135f704b2997968a2cf477b8
> metastore/src/java/org/apache/hadoop/hive/metastore/MetaStoreUtils.java 88151a1d48b12cf3a8346ae94b6d1a182a331992
> service/src/java/org/apache/hive/service/auth/HiveAuthFactory.java 1809e1b26ceee5de14a354a0e499aa8c0ab793bf
> service/src/java/org/apache/hive/service/auth/KerberosSaslHelper.java 379dafb8377aed55e74f0ae18407996bb9e1216f
> service/src/java/org/apache/hive/service/auth/SaslQOP.java PRE-CREATION
> shims/src/common-secure/java/org/apache/hadoop/hive/thrift/HadoopThriftAuthBridge20S.java 777226f8da0af2235d4294cd6a676fa8192c89e4
> shims/src/common/java/org/apache/hadoop/hive/thrift/HadoopThriftAuthBridge.java 9b0ec0a75563b41339e6fc747556440fdf83e31e
>
> Diff: https://reviews.apache.org/r/12824/diff/
>
>
> Testing
> -------
>
>
> Thanks,
>
> Arup Malakar
>
>
Re: Review Request 12824: [HIVE-4911] Enable QOP configuration for Hive
Server 2 thrift transport
Posted by Thejas Nair <th...@hortonworks.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/12824/#review23711
-----------------------------------------------------------
data/conf/hive-site.xml
<https://reviews.apache.org/r/12824/#comment47589>
This change should go into conf/hive-default.xml.template .
data/conf/hive-site.xml is meant to be used for overriding config parameters for the tests. In this case as default value is being used, this file does not need changing.
jdbc/src/java/org/apache/hive/jdbc/HiveConnection.java
<https://reviews.apache.org/r/12824/#comment47597>
the HIVE_AUTH_TYPE env variable is called "auth".
Should we use something more descriptive like "sasl.qop" as the variable that sets the QOP level.
jdbc/src/java/org/apache/hive/jdbc/HiveConnection.java
<https://reviews.apache.org/r/12824/#comment47590>
It is a good general practice to chain the exceptions.
-
throw new SQLException("Invalid " + HIVE_AUTH_TYPE + " parameter. " + e.getMessage(), "42000", e);
service/src/java/org/apache/hive/service/auth/HiveAuthFactory.java
<https://reviews.apache.org/r/12824/#comment47596>
I think hadoop.rpc.protection being set to a higher level than hive.server2.thrift.rpc.protection does not make sense in most situations (you would want to have more security in the transport that is likely to be more unsecure. THe HS2 -> client transport could be over a corporate wide wi-fi network)
Should we warn if such a configuration is seen ?
shims/src/common-secure/java/org/apache/hadoop/hive/thrift/HadoopThriftAuthBridge20S.java
<https://reviews.apache.org/r/12824/#comment47595>
This function is called from hive metastore client. Using SaslRpcServer.SASL_PROPS here means that setting hadoop.rpc.protection will determine the QOP level, if we make a call to SaslRpcServer.init(conf) from anywhere in the code. But that function is not being called.
I think it makes sense to use hadoop.rpc.protection for metastore QOP, since metastore usually not exposed 'outside' the cluster unlike hive server2. It is often viewed as something 'inside the cluster'.
Should we change this function to take in a configuration object and use that to call SaslRpcServer.init(conf) ?
- Thejas Nair
On July 22, 2013, 8:56 p.m., Arup Malakar wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/12824/
> -----------------------------------------------------------
>
> (Updated July 22, 2013, 8:56 p.m.)
>
>
> Review request for hive.
>
>
> Bugs: HIVE-4911
> https://issues.apache.org/jira/browse/HIVE-4911
>
>
> Repository: hive-git
>
>
> Description
> -------
>
> The QoP for hive server 2 should be configurable to enable encryption. A new configuration should be exposed "hive.server2.thrift.rpc.protection". This would give greater control configuring hive server 2 service.
>
>
> Diffs
> -----
>
> common/src/java/org/apache/hadoop/hive/conf/HiveConf.java 11c31216495d0c4e454f2627af5c93a9f270b1fe
> data/conf/hive-site.xml 4e6ff16135833da1a4df12a12a6fe59ad4f870ba
> jdbc/src/java/org/apache/hive/jdbc/HiveConnection.java 00f43511b478c687b7811fc8ad66af2b507a3626
> service/src/java/org/apache/hive/service/auth/HiveAuthFactory.java 1809e1b26ceee5de14a354a0e499aa8c0ab793bf
> service/src/java/org/apache/hive/service/auth/KerberosSaslHelper.java 379dafb8377aed55e74f0ae18407996bb9e1216f
> service/src/java/org/apache/hive/service/auth/SaslQOP.java PRE-CREATION
> shims/src/common-secure/java/org/apache/hadoop/hive/thrift/HadoopThriftAuthBridge20S.java 777226f8da0af2235d4294cd6a676fa8192c89e4
> shims/src/common/java/org/apache/hadoop/hive/thrift/HadoopThriftAuthBridge.java 9b0ec0a75563b41339e6fc747556440fdf83e31e
>
> Diff: https://reviews.apache.org/r/12824/diff/
>
>
> Testing
> -------
>
>
> Thanks,
>
> Arup Malakar
>
>
Re: Review Request 12824: [HIVE-4911] Enable QOP configuration for Hive
Server 2 thrift transport
Posted by Arup Malakar <am...@gmail.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/12824/
-----------------------------------------------------------
(Updated Aug. 5, 2013, 6:54 p.m.)
Review request for hive.
Changes
-------
Rebased.
Bugs: HIVE-4911
https://issues.apache.org/jira/browse/HIVE-4911
Repository: hive-git
Description
-------
The QoP for hive server 2 should be configurable to enable encryption. A new configuration should be exposed "hive.server2.thrift.rpc.protection". This would give greater control configuring hive server 2 service.
Diffs (updated)
-----
common/src/java/org/apache/hadoop/hive/conf/HiveConf.java 555343ebffb9dcd5e58d5b99ce9ca52904f68ecf
conf/hive-default.xml.template f01e715e4de95b4011210143f7d3add2d8a4d432
jdbc/src/java/org/apache/hive/jdbc/HiveConnection.java 00f43511b478c687b7811fc8ad66af2b507a3626
metastore/src/java/org/apache/hadoop/hive/metastore/HiveMetaStore.java cde58c25991641573453217da71a7ac1acf6adfd
metastore/src/java/org/apache/hadoop/hive/metastore/HiveMetaStoreClient.java cef50f40ccb047a8135f704b2997968a2cf477b8
metastore/src/java/org/apache/hadoop/hive/metastore/MetaStoreUtils.java 88151a1d48b12cf3a8346ae94b6d1a182a331992
service/src/java/org/apache/hive/service/auth/HiveAuthFactory.java 1809e1b26ceee5de14a354a0e499aa8c0ab793bf
service/src/java/org/apache/hive/service/auth/KerberosSaslHelper.java 379dafb8377aed55e74f0ae18407996bb9e1216f
service/src/java/org/apache/hive/service/auth/SaslQOP.java PRE-CREATION
shims/src/common-secure/java/org/apache/hadoop/hive/thrift/HadoopThriftAuthBridge20S.java 1df6993cb9aac1bb195667b3123faee27d657c0a
shims/src/common-secure/test/org/apache/hadoop/hive/thrift/TestHadoop20SAuthBridge.java 3e850ec3991cbb2d4343969ba8fe9df4a7d137b5
shims/src/common/java/org/apache/hadoop/hive/thrift/HadoopThriftAuthBridge.java ab7f5c0eb5345e68e3f223c9dfed8414de946661
Diff: https://reviews.apache.org/r/12824/diff/
Testing
-------
Thanks,
Arup Malakar
Re: Review Request 12824: [HIVE-4911] Enable QOP configuration for Hive
Server 2 thrift transport
Posted by Arup Malakar <am...@gmail.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/12824/
-----------------------------------------------------------
(Updated Aug. 2, 2013, 10:51 p.m.)
Review request for hive.
Changes
-------
1. Incorporated sasl.qop renaming of param
2. Moved getHadoopSaslProperties to HadoopThriftAuthBridge
Bugs: HIVE-4911
https://issues.apache.org/jira/browse/HIVE-4911
Repository: hive-git
Description
-------
The QoP for hive server 2 should be configurable to enable encryption. A new configuration should be exposed "hive.server2.thrift.rpc.protection". This would give greater control configuring hive server 2 service.
Diffs (updated)
-----
common/src/java/org/apache/hadoop/hive/conf/HiveConf.java 11c31216495d0c4e454f2627af5c93a9f270b1fe
conf/hive-default.xml.template 603b475802152a4bd5ab92a4c7146b56f6be020d
jdbc/src/java/org/apache/hive/jdbc/HiveConnection.java 00f43511b478c687b7811fc8ad66af2b507a3626
metastore/src/java/org/apache/hadoop/hive/metastore/HiveMetaStore.java 72eac989394a3899998e52d3845b02bb38ebeaad
metastore/src/java/org/apache/hadoop/hive/metastore/HiveMetaStoreClient.java cef50f40ccb047a8135f704b2997968a2cf477b8
metastore/src/java/org/apache/hadoop/hive/metastore/MetaStoreUtils.java 88151a1d48b12cf3a8346ae94b6d1a182a331992
service/src/java/org/apache/hive/service/auth/HiveAuthFactory.java 1809e1b26ceee5de14a354a0e499aa8c0ab793bf
service/src/java/org/apache/hive/service/auth/KerberosSaslHelper.java 379dafb8377aed55e74f0ae18407996bb9e1216f
service/src/java/org/apache/hive/service/auth/SaslQOP.java PRE-CREATION
shims/src/common-secure/java/org/apache/hadoop/hive/thrift/HadoopThriftAuthBridge20S.java 777226f8da0af2235d4294cd6a676fa8192c89e4
shims/src/common-secure/test/org/apache/hadoop/hive/thrift/TestHadoop20SAuthBridge.java 172e03115372dc2c742469cbc5f0fefd1053163d
shims/src/common/java/org/apache/hadoop/hive/thrift/HadoopThriftAuthBridge.java 9b0ec0a75563b41339e6fc747556440fdf83e31e
Diff: https://reviews.apache.org/r/12824/diff/
Testing
-------
Thanks,
Arup Malakar
Re: Review Request 12824: [HIVE-4911] Enable QOP configuration for Hive
Server 2 thrift transport
Posted by Arup Malakar <am...@gmail.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/12824/
-----------------------------------------------------------
(Updated July 24, 2013, 4:43 p.m.)
Review request for hive.
Changes
-------
Thank you Thejas for the review. I have fixed incorporated most of them except the HIVE_AUTH_TYPE comment. Let me know what you think would be the best approach given HIVE-4232 is not committed.
Bugs: HIVE-4911
https://issues.apache.org/jira/browse/HIVE-4911
Repository: hive-git
Description
-------
The QoP for hive server 2 should be configurable to enable encryption. A new configuration should be exposed "hive.server2.thrift.rpc.protection". This would give greater control configuring hive server 2 service.
Diffs (updated)
-----
common/src/java/org/apache/hadoop/hive/conf/HiveConf.java 11c31216495d0c4e454f2627af5c93a9f270b1fe
conf/hive-default.xml.template 603b475802152a4bd5ab92a4c7146b56f6be020d
jdbc/src/java/org/apache/hive/jdbc/HiveConnection.java 00f43511b478c687b7811fc8ad66af2b507a3626
metastore/src/java/org/apache/hadoop/hive/metastore/HiveMetaStore.java 72eac989394a3899998e52d3845b02bb38ebeaad
metastore/src/java/org/apache/hadoop/hive/metastore/HiveMetaStoreClient.java cef50f40ccb047a8135f704b2997968a2cf477b8
metastore/src/java/org/apache/hadoop/hive/metastore/MetaStoreUtils.java 88151a1d48b12cf3a8346ae94b6d1a182a331992
service/src/java/org/apache/hive/service/auth/HiveAuthFactory.java 1809e1b26ceee5de14a354a0e499aa8c0ab793bf
service/src/java/org/apache/hive/service/auth/KerberosSaslHelper.java 379dafb8377aed55e74f0ae18407996bb9e1216f
service/src/java/org/apache/hive/service/auth/SaslQOP.java PRE-CREATION
shims/src/common-secure/java/org/apache/hadoop/hive/thrift/HadoopThriftAuthBridge20S.java 777226f8da0af2235d4294cd6a676fa8192c89e4
shims/src/common/java/org/apache/hadoop/hive/thrift/HadoopThriftAuthBridge.java 9b0ec0a75563b41339e6fc747556440fdf83e31e
Diff: https://reviews.apache.org/r/12824/diff/
Testing
-------
Thanks,
Arup Malakar