You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues-all@impala.apache.org by "ASF subversion and git services (JIRA)" <ji...@apache.org> on 2018/10/20 06:45:00 UTC
[jira] [Commented] (IMPALA-7343) Change Sentry proxy to use the
bulk API
[ https://issues.apache.org/jira/browse/IMPALA-7343?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16657762#comment-16657762 ]
ASF subversion and git services commented on IMPALA-7343:
---------------------------------------------------------
Commit 072f3ee9045d62cceb23f1f416f3052e0024cdcd in impala's branch refs/heads/master from [~fredyw]
[ https://git-wip-us.apache.org/repos/asf?p=impala.git;h=072f3ee ]
IMPALA-7729: Fix invalidate metadata hang when there is an upper case role name
Sentry stores the role names in lower case and Impala stores the role
names based on the original input role names. IMPALA-7343 introduced
a new bulk API (listAllRolesPrivileges) from Sentry that returns a map
of role name to a set of privileges. Since Impala preserves the case
sensitivity of the role names based on the original input role names,
this causes an issue when trying to retrieve a set of privileges from
a role name that is stored in Impala, especially when the role names in
Impala differ than the ones returned by listAllRolesPrivileges. This
issue will then result in privileges with mismatch role names to never
get refreshed in the Catalogd, which causes Impalad to wait indefinitely
waiting for the privileges to be updated by Catalogd. The fix is to get
a set of privileges using the role names returned by Sentry's
listAllRoles instead of using the role names stored in Impala.
Testing:
- Added a new E2E test
- Ran all E2E authorization tests
Change-Id: I5aa6f626ad3df4e9321ed18273d045517bc099c2
Reviewed-on: http://gerrit.cloudera.org:8080/11734
Reviewed-by: Impala Public Jenkins <im...@cloudera.com>
Tested-by: Impala Public Jenkins <im...@cloudera.com>
> Change Sentry proxy to use the bulk API
> ---------------------------------------
>
> Key: IMPALA-7343
> URL: https://issues.apache.org/jira/browse/IMPALA-7343
> Project: IMPALA
> Issue Type: Sub-task
> Components: Frontend
> Affects Versions: Impala 3.0
> Reporter: Adam Holley
> Assignee: Fredy Wijaya
> Priority: Major
> Labels: security
> Fix For: Impala 3.1.0
>
>
> Currently, Impala makes a thrift call for each role to get privileges. This will change to get all privileges in one thrift call.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-all-unsubscribe@impala.apache.org
For additional commands, e-mail: issues-all-help@impala.apache.org