You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@kyuubi.apache.org by GitBox <gi...@apache.org> on 2021/12/24 07:56:43 UTC
[GitHub] [incubator-kyuubi] gongzh021 opened a new issue #1627: [Bug] Kyuubi submitted the GROUP as a USER to RANGER for authentication.
gongzh021 opened a new issue #1627:
URL: https://github.com/apache/incubator-kyuubi/issues/1627
### Code of Conduct
- [X] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)
### Search before asking
- [X] I have searched in the [issues](https://github.com/apache/incubator-kyuubi/issues?q=is%3Aissue) and found no similar issues.
### Describe the bug
Kyuubi-1.4 uses GROUP isolation and RANGER permission authentication.
Kyuubi submitted the GROUP as a USER to RANGER for authentication.
This requires the creation of corresponding users in RANGER system.
Only then can authority management be realized.
### Affects Version(s)
1.4.0
### Kyuubi Server Log Output
_No response_
### Kyuubi Engine Log Output
_No response_
### Kyuubi Server Configurations
_No response_
### Kyuubi Engine Configurations
_No response_
### Additional context
_No response_
### Are you willing to submit PR?
- [X] Yes I am willing to submit a PR!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-kyuubi] yaooqinn commented on issue #1627: [Bug] Kyuubi submitted the GROUP as a USER to RANGER for authentication.
Posted by GitBox <gi...@apache.org>.
yaooqinn commented on issue #1627:
URL: https://github.com/apache/incubator-kyuubi/issues/1627#issuecomment-1002868300
That said, a user can use arbitrary GROUPs？
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-kyuubi] gongzh021 commented on issue #1627: [Bug] Kyuubi submitted the GROUP as a USER to RANGER for authentication.
Posted by GitBox <gi...@apache.org>.
gongzh021 commented on issue #1627:
URL: https://github.com/apache/incubator-kyuubi/issues/1627#issuecomment-1002868333
> can you detail the user-group mapping logic and corresponding authentication and authorization?
> ### Code of Conduct
> * [x] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)
>
> ### Search before asking
> * [x] I have searched in the [issues](https://github.com/apache/incubator-kyuubi/issues?q=is%3Aissue) and found no similar issues.
>
> ### Describe the bug
> Kyuubi-1.4 uses GROUP isolation and RANGER permission authentication. Kyuubi submitted the GROUP as a USER to RANGER for authentication. This requires the creation of corresponding users in RANGER system. Only then can authority management be realized.
>
> ### Affects Version(s)
> 1.4.0
>
> ### Kyuubi Server Log Output
> _No response_
>
> ### Kyuubi Engine Log Output
> _No response_
>
> ### Kyuubi Server Configurations
> _No response_
>
> ### Kyuubi Engine Configurations
> _No response_
>
> ### Additional context
> _No response_
>
> ### Are you willing to submit PR?
> * [x] Yes I am willing to submit a PR!
Here is a problem and a demand.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-kyuubi] yaooqinn commented on issue #1627: [Bug] Kyuubi submitted the GROUP as a USER to RANGER for authentication.
Posted by GitBox <gi...@apache.org>.
yaooqinn commented on issue #1627:
URL: https://github.com/apache/incubator-kyuubi/issues/1627#issuecomment-1002870471
What do you mean by ranger authentication? what authentication method do you use for ranger admin?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-kyuubi] gongzh021 commented on issue #1627: [Bug] Kyuubi submitted the GROUP as a USER to RANGER for authentication.
Posted by GitBox <gi...@apache.org>.
gongzh021 commented on issue #1627:
URL: https://github.com/apache/incubator-kyuubi/issues/1627#issuecomment-1000980452
I hope I can set it in jdbc connection string.
my hope can set it in jdbc connection string.
Because hadoop group has other uses.
There is no security problem with this setting, so I hope I can set it like this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-kyuubi] gongzh021 commented on issue #1627: [Bug] Kyuubi submitted the GROUP as a USER to RANGER for authentication.
Posted by GitBox <gi...@apache.org>.
gongzh021 commented on issue #1627:
URL: https://github.com/apache/incubator-kyuubi/issues/1627#issuecomment-1000980523
my hope can set it in jdbc connection string.
Because hadoop group has other uses.
There is no security problem with this setting, so I hope I can set it like this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-kyuubi] gongzh021 commented on issue #1627: [Bug] Kyuubi submitted the GROUP as a USER to RANGER for authentication.
Posted by GitBox <gi...@apache.org>.
gongzh021 commented on issue #1627:
URL: https://github.com/apache/incubator-kyuubi/issues/1627#issuecomment-1002865738
> > my hope can set it in jdbc connection string. Because hadoop group has other uses. There is no security problem with this setting, so I hope I can set it like this.
>
> do youmean set group name in URL？
Yes
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-kyuubi] yaooqinn commented on issue #1627: [Bug] Kyuubi submitted the GROUP as a USER to RANGER for authentication.
Posted by GitBox <gi...@apache.org>.
yaooqinn commented on issue #1627:
URL: https://github.com/apache/incubator-kyuubi/issues/1627#issuecomment-1002868935
> Yes
Even without ACL permissions to that group？ that's a dangerous behavior
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-kyuubi] gongzh021 commented on issue #1627: [Bug] Kyuubi submitted the GROUP as a USER to RANGER for authentication.
Posted by GitBox <gi...@apache.org>.
gongzh021 commented on issue #1627:
URL: https://github.com/apache/incubator-kyuubi/issues/1627#issuecomment-1002868489
> That said, a user can use arbitrary GROUPs？
Yes
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-kyuubi] gongzh021 commented on issue #1627: [Bug] Kyuubi submitted the GROUP as a USER to RANGER for authentication.
Posted by GitBox <gi...@apache.org>.
gongzh021 commented on issue #1627:
URL: https://github.com/apache/incubator-kyuubi/issues/1627#issuecomment-1002869845
> > Yes
>
> Even without ACL permissions to that group？ that's a dangerous behavior
Then ignore this demand.
Consider this bug.
Kyuubi submitted the group name as a user name to ranger for authentication.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-kyuubi] yaooqinn commented on issue #1627: [Bug] Kyuubi submitted the GROUP as a USER to RANGER for authentication.
Posted by GitBox <gi...@apache.org>.
yaooqinn commented on issue #1627:
URL: https://github.com/apache/incubator-kyuubi/issues/1627#issuecomment-1002866580
can you detail the user-group mapping logic and corresponding authentication and authorization?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-kyuubi] gongzh021 commented on issue #1627: [Bug] Kyuubi submitted the GROUP as a USER to RANGER for authentication.
Posted by GitBox <gi...@apache.org>.
gongzh021 commented on issue #1627:
URL: https://github.com/apache/incubator-kyuubi/issues/1627#issuecomment-1002867653
>
> can you detail the user-group mapping logic and corresponding authentication and authorization?
I just want to set the isolation level, and I am not responsible for permission verification.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-kyuubi] gongzh021 removed a comment on issue #1627: [Bug] Kyuubi submitted the GROUP as a USER to RANGER for authentication.
Posted by GitBox <gi...@apache.org>.
gongzh021 removed a comment on issue #1627:
URL: https://github.com/apache/incubator-kyuubi/issues/1627#issuecomment-1000980452
I hope I can set it in jdbc connection string.
my hope can set it in jdbc connection string.
Because hadoop group has other uses.
There is no security problem with this setting, so I hope I can set it like this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-kyuubi] yaooqinn commented on issue #1627: [Bug] Kyuubi submitted the GROUP as a USER to RANGER for authentication.
Posted by GitBox <gi...@apache.org>.
yaooqinn commented on issue #1627:
URL: https://github.com/apache/incubator-kyuubi/issues/1627#issuecomment-1001025533
> my hope can set it in jdbc connection string. Because hadoop group has other uses. There is no security problem with this setting, so I hope I can set it like this.
do youmean set group name in URL？
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org