[jira] [Comment Edited] (IMPALA-5552) Proxy user list should support groups

["Tristan Stevens (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/IMPALA-5552?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16522596#comment-16522596 ] 

Tristan Stevens edited comment on IMPALA-5552 at 6/25/18 5:46 PM:
------------------------------------------------------------------

Hi [~fredyw]
I would have thought that most users use shell-based Hadoop groups, ideally from the NN, but if not then locally. Is this possible to implement?
Thanks


was (Author: tmgstev):
Hi [~fredyw]
I would have thought that most customers use shell-based Hadoop groups, ideally from the NN, but if not then locally. Is this possible to implement?
Thanks

> Proxy user list should support groups
> -------------------------------------
>
>                 Key: IMPALA-5552
>                 URL: https://issues.apache.org/jira/browse/IMPALA-5552
>             Project: IMPALA
>          Issue Type: Improvement
>          Components: Frontend
>            Reporter: Tristan Stevens
>            Assignee: Fredy Wijaya
>            Priority: Critical
>             Fix For: Impala 2.13.0, Impala 3.1.0
>
>
> The authorized_proxy_user_config takes a map of user->doAsUser* - i.e. user is allowed to impersonate any users in the list of doAsUsers.
> For enterprise deployments, this would be better specified as a list of groups, rather than a a list of users:
> user1->group*
> When accepting a query, Impala will check that the doAs user is a member of any of the list of groups specified for the connecting user.
> HiveServer2 does this via Hadoop-level proxy user privileges (e.g.
>  {{<property>
>   <name>hadoop.proxyuser.user1.hosts</name>
>   <value>doAsUser1,doAsUser2</value>
> </property>
> <property>
>   <name>hadoop.proxyuser.user1.groups</name>
>   <value>doAsGroup1,doAsGroup2</value>
> </property>}}



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-all-unsubscribe@impala.apache.org
For additional commands, e-mail: issues-all-help@impala.apache.org