You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by GitBox <gi...@apache.org> on 2020/06/26 14:25:14 UTC
[GitHub] [incubator-superset] 0xBADBAC0N opened a new pull request #10172: fix: make auth for hive optional
0xBADBAC0N opened a new pull request #10172:
URL: https://github.com/apache/incubator-superset/pull/10172
This will make allow the admin to set up a root connection that can be impersonated.
### SUMMARY
<!--- Describe the change below, including rationale and design decisions -->
If a root Hive connection is used liked in Hue, we want to simply impersonate that single connection to allow Apache Sentry/Ranger to manage user rights regarding databases/tables. If we enforce the auth param, we also are forced to set credentials on that connection, although we want to use a dedicated hive-server and connection in combination with Apache Sentry/Range, similar to Hue.
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
<!--- Skip this if not applicable -->
### TEST PLAN
<!--- What steps should be taken to verify the changes -->
Set up an unprotected Hive server and add that connection.
```
hive://myhive01.example:10000
```
Select impersonation.
Without the auth flags (eG the submitted fix) Superset is able to impersonate the connection properly.
If the auth setting is set (eG to LDAP or Kerberos) Superset expects username:password in the connection string, although it is not required.
To verify the correct behavior, set the connection, check impersonation, and do not modify the `Extra` settings.
An open connection should still be able to impersonate the connection.
### ADDITIONAL INFORMATION
<!--- Check any relevant boxes with "x" -->
<!--- HINT: Include "Fixes #nnn" if you are fixing an existing issue -->
- [x] Has associated issue:
https://github.com/apache/incubator-superset/issues/8406 (unsolved)
- [ ] Changes UI
- [ ] Requires DB Migration.
- [ ] Confirm DB Migration upgrade and downgrade tested.
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [incubator-superset] 0xBADBAC0N commented on a change in pull request #10172: fix: make auth for hive optional
Posted by GitBox <gi...@apache.org>.
0xBADBAC0N commented on a change in pull request #10172:
URL: https://github.com/apache/incubator-superset/pull/10172#discussion_r446442534
##########
File path: superset/db_engine_specs/hive.py
##########
@@ -437,14 +437,9 @@ def get_configuration_for_impersonation(
url = make_url(uri)
backend_name = url.get_backend_name()
- # Must be Hive connection, enable impersonation, and set param
+ # Must be Hive connection, enable impersonation, and set optional param
# auth=LDAP|KERBEROS
- if (
- backend_name == "hive"
- and "auth" in url.query.keys()
- and impersonate_user is True
- and username is not None
- ):
+ if backend_name == "hive" and impersonate_user is True and username is not None:
Review comment:
Sure, done :)
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [incubator-superset] villebro merged pull request #10172: fix: make auth for hive optional
Posted by GitBox <gi...@apache.org>.
villebro merged pull request #10172:
URL: https://github.com/apache/incubator-superset/pull/10172
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [incubator-superset] john-bodley commented on a change in pull request #10172: fix: make auth for hive optional
Posted by GitBox <gi...@apache.org>.
john-bodley commented on a change in pull request #10172:
URL: https://github.com/apache/incubator-superset/pull/10172#discussion_r446395434
##########
File path: superset/db_engine_specs/hive.py
##########
@@ -437,14 +437,9 @@ def get_configuration_for_impersonation(
url = make_url(uri)
backend_name = url.get_backend_name()
- # Must be Hive connection, enable impersonation, and set param
+ # Must be Hive connection, enable impersonation, and set optional param
# auth=LDAP|KERBEROS
- if (
- backend_name == "hive"
- and "auth" in url.query.keys()
- and impersonate_user is True
- and username is not None
- ):
+ if backend_name == "hive" and impersonate_user is True and username is not None:
Review comment:
Could you also replace `impersonate_user is True` with `impersonate_user`?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org