You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@drill.apache.org by GitBox <gi...@apache.org> on 2021/08/18 09:41:45 UTC
[GitHub] [drill] Z0ltrix opened a new issue #2296: username as dynamic property in storage plugin
Z0ltrix opened a new issue #2296:
URL: https://github.com/apache/drill/issues/2296
**Is your feature request related to a problem? Please describe.**
I would like to use Phoenix-Queryserver with active impersonation through jdbc storage plugin in drill.
At the moment we got phoenix-queryserver to work with kerberos auth and a specific keytab for drill. Drill is configured with active impersonation, so if Bob submits a query to drill, drill impersonates Bob agains HDFS and HBase.
Because of the fixed keytab and principals in jdbc string, all queries against phoenix are submitted with the user specified at the keytab.
To fulfill all security requirements we need active impersonation against phoenix.
**Describe the solution you'd like**
I would like to specify the original username of the drill query in the connection string of the jdbc storage plugin, as it is described here: https://phoenix.apache.org/server.html#Impersonation
```
{
"type": "jdbc",
"driver": "org.apache.phoenix.queryserver.client.Driver",
"url": "jdbc:phoenix:thin:url=http://localhost:8765?doAs=$user;serialization=PROTOBUF;authentication=SPNEGO;principal=drill/bit@MY.CLUSTER;keytab=/etc/hadoop/conf/drill.keytab",
"username": null,
"password": null,
"caseInsensitiveTableNames": false,
"enabled": true
}
```
If Bob sends a Query like `SELECT * FROM phoenix.schema.table` drill should sends the query with doAs=Bob
**Describe alternatives you've considered**
none
**Additional context**
none
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@drill.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [drill] Z0ltrix commented on issue #2296: username as dynamic property in storage plugin
Posted by GitBox <gi...@apache.org>.
Z0ltrix commented on issue #2296:
URL: https://github.com/apache/drill/issues/2296#issuecomment-901994708
Hi @cgivre ,
yes i saw this new feature, but i have not found any hint on how to forward the currently impersonated enduser by drill to the storage plugin.
I dont want do specify the username at the plugin, i want to impersonate the enduser directly to the storage plugin.
Im not sure if i missed something but maybe you can guide me to the right lines in code or give me an config example for this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@drill.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [drill] cgivre commented on issue #2296: username as dynamic property in storage plugin
Posted by GitBox <gi...@apache.org>.
cgivre commented on issue #2296:
URL: https://github.com/apache/drill/issues/2296#issuecomment-901972587
Hi Christian,
I think this actually might be a very easy fix.
Good News: As part of DRILL-7855 [1] we introduced a password vault to Drill which enables user impersonation for all storage plugins. Here is the documentation for this feature [2].
Not Great News: I'm not exactly sure whether this was enabled for the JDBC plugin. If it isn't, it is not that difficult to add this to the config for any plugin.
1: https://github.com/apache/drill/pull/2162 <https://github.com/apache/drill/pull/2162>
2.: https://github.com/apache/drill/blob/master/docs/dev/PluginCredentialsProvider.md <https://github.com/apache/drill/blob/master/docs/dev/PluginCredentialsProvider.md>
Best,
-- C
> On Aug 19, 2021, at 3:54 AM, Christian Pfarr ***@***.***> wrote:
>
>
> Hi @luocooong <https://github.com/luocooong>,
>
> ok, understood that storage plugin is loaded by drill itself before user logs in. So there is no way to specify it at the plugin config.
> Is there any other way to do this at query time?
>
> How is Impersonation handled for hdfs and hbase?
>
> Im open for everything else that gets the initial idea to work. Maybe we should rename the feature request to "jdbc impersonation support" or something else.
>
> —
> You are receiving this because you are subscribed to this thread.
> Reply to this email directly, view it on GitHub <https://github.com/apache/drill/issues/2296#issuecomment-901692931>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABKB7PVBRQZRJYQ7BYXG7JLT5S2EXANCNFSM5CLU4IVQ>.
> Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&utm_campaign=notification-email>.
>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@drill.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [drill] Z0ltrix commented on issue #2296: username as dynamic property in storage plugin
Posted by GitBox <gi...@apache.org>.
Z0ltrix commented on issue #2296:
URL: https://github.com/apache/drill/issues/2296#issuecomment-901692931
Hi @luocooong,
ok, understood that storage plugin is loaded by drill itself before user logs in. So there is no way to specify it at the plugin config.
Is there any other way to do this at query time?
How is Impersonation handled for hdfs and hbase?
Im open for everything else that gets the initial idea to work. Maybe we should rename the feature request to "jdbc impersonation support" or something else.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@drill.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [drill] luocooong closed issue #2296: username as dynamic property in storage plugin
Posted by GitBox <gi...@apache.org>.
luocooong closed issue #2296:
URL: https://github.com/apache/drill/issues/2296
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@drill.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [drill] luocooong commented on issue #2296: username as dynamic property in storage plugin
Posted by GitBox <gi...@apache.org>.
luocooong commented on issue #2296:
URL: https://github.com/apache/drill/issues/2296#issuecomment-901689722
@Z0ltrix Thanks for the idea. As I understand it, need Drill to know who sent this request. Drill executes client requests as the user logged in to the client ([Authentication](https://drill.apache.org/docs/securing-drill-introduction/) support the PAM and Kerberos if [Impersonation](https://drill.apache.org/docs/configuring-user-impersonation/) is configured). So, user can passes the query request (and the user credentials) to storage layer once successfully login in the drill use the PAM (or krb ?). But, neither PAM nor Kerberos may be a direct user on the application layer. In other words, both PAM and Kerberos are not flexible in setup.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@drill.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org