You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues-all@impala.apache.org by "ASF subversion and git services (JIRA)" <ji...@apache.org> on 2018/11/19 18:48:00 UTC
[jira] [Commented] (IMPALA-7585) Always set user credentials after
creating a KRPC proxy
[ https://issues.apache.org/jira/browse/IMPALA-7585?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16692110#comment-16692110 ]
ASF subversion and git services commented on IMPALA-7585:
---------------------------------------------------------
Commit e1c9cbd0771cd01776c2db79cf753bf73d786e5a in impala's branch refs/heads/master from [~jbapple]
[ https://git-wip-us.apache.org/repos/asf?p=impala.git;h=e1c9cbd ]
IMPALA-7585: support LDAP in run-workload.py
This patch just threads through the user, password, and ssl settings
all the way back to the ImpalaBeeswaxClient.
Change-Id: Ibfa987d8a027f50bc1ba3db5aa355331442a74ba
Reviewed-on: http://gerrit.cloudera.org:8080/11938
Tested-by: Impala Public Jenkins <im...@cloudera.com>
Reviewed-by: David Knupp <dk...@cloudera.com>
> Always set user credentials after creating a KRPC proxy
> -------------------------------------------------------
>
> Key: IMPALA-7585
> URL: https://issues.apache.org/jira/browse/IMPALA-7585
> Project: IMPALA
> Issue Type: Bug
> Components: Distributed Exec
> Affects Versions: Impala 3.0, Impala 2.12.0
> Reporter: Michael Ho
> Assignee: Michael Ho
> Priority: Major
> Fix For: Impala 3.1.0
>
>
> {{kudu::rpc::Proxy}} ctor may fail in {{GetLoggedInUser()}} for various reason:
> {noformat}
> Error calling getpwuid_r(): No such file or directory (error 2).
> {noformat}
> This resulted in an empty user name being used in {{kudu::rpc::ConnectionId}}. With plaintext SASL (e.g. in an insecure Impala cluster), this may result in the following error:
> {noformat}
> Not authorized: Client connection negotiation failed: client connection to 127.0.0.1:27000: SASL(-1): generic failure: All-whitespace username.
> {noformat}
> While one can argue that Kudu should fall back to some default username (e.g. "cpp-client") when {{GetLoggedInUserName()}} fails, it may have non-trivial consequence (e.g. generating an authn token with some random username on one machine while using the real user name on another machine). Therefore, it's best for Impala to explicitly set the user credentials (impala/<some-hostname>) after creating the proxy.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-all-unsubscribe@impala.apache.org
For additional commands, e-mail: issues-all-help@impala.apache.org