Gabriel39 commented on code in PR #66890:
URL: https://github.com/apache/doris/pull/66890#discussion_r3803246308
##########
fe/fe-connector/fe-connector-hive/src/main/java/org/apache/doris/connector/hive/HiveConnector.java:
##########
@@ -596,9 +598,9 @@ private HmsClient createClient() {
context.getCatalogName(), config.getMetastoreUri(),
config.getMetastoreType(), poolSize);
- // For a Kerberos catalog run the metastore RPC under the PLUGIN's UGI
doAs (buildPluginAuthenticator),
- // NOT the FE-injected context: after the catalog flip that context
resolves to NOOP (SIMPLE) auth, which
- // would silently downgrade a Kerberos HMS. AuthAction.execute is a
generic method (<T> T execute(...)),
+ // Run the metastore RPC under the PLUGIN's UGI doAs
(buildPluginAuthenticator), NOT the FE-injected
+ // context: after the catalog flip that context resolves to NOOP auth
and loses both the configured simple
Review Comment:
Fixed in cff1fe75520. Hudi now applies a dedicated HMS authenticator only
around ThriftHmsClient RPCs, while Iceberg and Paimon wrap their HMS client
pools so client acquisition and every RPC run under the resolved HMS UGI.
Storage authentication remains separate. Paimon catalog construction also
covers its eager SIMPLE client creation, and both static SDK pools now include
configuration-derived SIMPLE/Kerberos identities in their cache keys. Added
connector and client-pool regression tests.
##########
fe/fe-connector/fe-connector-hive/src/main/java/org/apache/doris/connector/hive/HiveConnector.java:
##########
@@ -681,6 +681,8 @@ private HadoopAuthenticator pluginAuthenticator() {
* {@link KerberosAuthenticationConfig}, so the {@code doAs} logs in
the same client identity fe-core
* used. The HMS <em>service</em> principal / SASL settings ride the
catalog's own HiveConf, not the
* login.</li>
+ * <li><b>Simple HMS</b> — the configured {@code
hive.metastore.username}/{@code hadoop.username}, or the
Review Comment:
Fixed in cff1fe75520. HMS authentication is now resolved before the storage
Kerberos fallback, so explicit SIMPLE keeps the configured metastore user and
the storage authenticator remains dedicated to FileIO. HmsConfHelper also no
longer enables HMS SASL from the storage Kerberos key when HMS explicitly
selects SIMPLE. Added mixed SIMPLE-HMS/Kerberos-storage tests for Hive, Hudi,
Iceberg, and Paimon.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
