You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@impala.apache.org by ta...@apache.org on 2018/10/02 17:33:24 UTC
[4/8] impala git commit: IMPALA-7646: SHOW GRANT USER does not work
for kerberos cluster
IMPALA-7646: SHOW GRANT USER does not work for kerberos cluster
This patch fixes the SHOW GRANT USER statement to properly check
that the requesting user short name matches the name in the
SHOW GRANT USER statement to determine whether or not an admin
check is required for showing the privileges. Previous to this
patch, the full kerberos user name, e.g. foo_user@REALM was
compared against "SHOW GRANT USER foo_user" and did not match
do admin privileges were required.
Testing:
- Ran all fe and custom cluster tests.
- Validated against kerberized cluster.
Change-Id: Iba4c627b72c8cbc323be25917698a75d153afd31
Reviewed-on: http://gerrit.cloudera.org:8080/11553
Reviewed-by: Fredy Wijaya <fw...@cloudera.com>
Tested-by: Impala Public Jenkins <im...@cloudera.com>
Project: http://git-wip-us.apache.org/repos/asf/impala/repo
Commit: http://git-wip-us.apache.org/repos/asf/impala/commit/a381483e
Tree: http://git-wip-us.apache.org/repos/asf/impala/tree/a381483e
Diff: http://git-wip-us.apache.org/repos/asf/impala/diff/a381483e
Branch: refs/heads/master
Commit: a381483e658f824d1639096e03f1a23b2a216c41
Parents: d918b2a
Author: Adam Holley <gi...@holleyism.com>
Authored: Mon Oct 1 11:23:57 2018 -0500
Committer: Impala Public Jenkins <im...@cloudera.com>
Committed: Mon Oct 1 22:48:46 2018 +0000
----------------------------------------------------------------------
fe/src/main/java/org/apache/impala/service/Frontend.java | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/impala/blob/a381483e/fe/src/main/java/org/apache/impala/service/Frontend.java
----------------------------------------------------------------------
diff --git a/fe/src/main/java/org/apache/impala/service/Frontend.java b/fe/src/main/java/org/apache/impala/service/Frontend.java
index ec6189f..d31b573 100644
--- a/fe/src/main/java/org/apache/impala/service/Frontend.java
+++ b/fe/src/main/java/org/apache/impala/service/Frontend.java
@@ -508,7 +508,7 @@ public class Frontend {
if (showGrantPrincipalStmt.getPrincipal().getPrincipalType()
== TPrincipalType.USER) {
requiresAdmin = !showGrantPrincipalStmt.getPrincipal().getName().equals(
- analysis.getAnalyzer().getUser().getName());
+ analysis.getAnalyzer().getUser().getShortName());
} else {
requiresAdmin = Sets.intersection(groupNames, showGrantPrincipalStmt
.getPrincipal().getGrantGroups()).isEmpty();