You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@hive.apache.org by th...@apache.org on 2017/01/24 00:58:47 UTC
hive git commit: Support HADOOP_PROXY_USER for secure impersonation
in hive metastore client (Nanda kumar via Thejas Nair)
Repository: hive
Updated Branches:
refs/heads/master 4a42bec6b -> 3f90794d8
Support HADOOP_PROXY_USER for secure impersonation in hive metastore client (Nanda kumar via Thejas Nair)
Project: http://git-wip-us.apache.org/repos/asf/hive/repo
Commit: http://git-wip-us.apache.org/repos/asf/hive/commit/3f90794d
Tree: http://git-wip-us.apache.org/repos/asf/hive/tree/3f90794d
Diff: http://git-wip-us.apache.org/repos/asf/hive/diff/3f90794d
Branch: refs/heads/master
Commit: 3f90794d872e90c29a068f16cdf3f45b1cf52c74
Parents: 4a42bec
Author: Nanda kumar <na...@gmail.com>
Authored: Mon Jan 23 16:58:28 2017 -0800
Committer: Thejas M Nair <th...@hortonworks.com>
Committed: Mon Jan 23 16:58:28 2017 -0800
----------------------------------------------------------------------
.../hive/metastore/HiveMetaStoreClient.java | 37 ++++++++++++++++++++
1 file changed, 37 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/hive/blob/3f90794d/metastore/src/java/org/apache/hadoop/hive/metastore/HiveMetaStoreClient.java
----------------------------------------------------------------------
diff --git a/metastore/src/java/org/apache/hadoop/hive/metastore/HiveMetaStoreClient.java b/metastore/src/java/org/apache/hadoop/hive/metastore/HiveMetaStoreClient.java
index 83b481c..b5d007d 100644
--- a/metastore/src/java/org/apache/hadoop/hive/metastore/HiveMetaStoreClient.java
+++ b/metastore/src/java/org/apache/hadoop/hive/metastore/HiveMetaStoreClient.java
@@ -45,6 +45,7 @@ import java.util.NoSuchElementException;
import java.util.Random;
import java.util.concurrent.TimeUnit;
import java.util.concurrent.atomic.AtomicInteger;
+import java.security.PrivilegedExceptionAction;
import javax.security.auth.login.LoginException;
@@ -201,6 +202,42 @@ public class HiveMetaStoreClient implements IMetaStoreClient {
LOG.error("NOT getting uris from conf");
throw new MetaException("MetaStoreURIs not found in conf file");
}
+
+ //If HADOOP_PROXY_USER is set in env or property,
+ //then need to create metastore client that proxies as that user.
+ String HADOOP_PROXY_USER = "HADOOP_PROXY_USER";
+ String proxyUser = System.getenv(HADOOP_PROXY_USER);
+ if (proxyUser == null) {
+ proxyUser = System.getProperty(HADOOP_PROXY_USER);
+ }
+ //if HADOOP_PROXY_USER is set, create DelegationToken using real user
+ if(proxyUser != null) {
+ LOG.info(HADOOP_PROXY_USER + " is set. Using delegation "
+ + "token for HiveMetaStore connection.");
+ try {
+ UserGroupInformation.getLoginUser().getRealUser().doAs(
+ new PrivilegedExceptionAction<Void>() {
+ @Override
+ public Void run() throws Exception {
+ open();
+ return null;
+ }
+ });
+ String delegationTokenPropString = "DelegationTokenForHiveMetaStoreServer";
+ String delegationTokenStr = getDelegationToken(proxyUser, proxyUser);
+ Utils.setTokenStr(UserGroupInformation.getCurrentUser(), delegationTokenStr,
+ delegationTokenPropString);
+ this.conf.setVar(ConfVars.METASTORE_TOKEN_SIGNATURE, delegationTokenPropString);
+ close();
+ } catch (Exception e) {
+ LOG.error("Error while setting delegation token for " + proxyUser, e);
+ if(e instanceof MetaException) {
+ throw (MetaException)e;
+ } else {
+ throw new MetaException(e.getMessage());
+ }
+ }
+ }
// finally open the store
open();
}