Gabriel39 commented on code in PR #66890:
URL: https://github.com/apache/doris/pull/66890#discussion_r3804162067
##########
fe/fe-connector/fe-connector-hive/src/main/java/org/apache/doris/connector/hive/HiveConnector.java:
##########
@@ -591,14 +592,19 @@ private HmsClient createClient() {
// getHmsClientProperties(), not the raw map: the metastore URI must
reach HiveConf under its canonical
// key even when the catalog spells it with the "uri" short form.
- HmsClientConfig config = new
HmsClientConfig(props.getHmsClientProperties(), poolSize);
+ AbstractHmsMetaStoreProperties hms = (AbstractHmsMetaStoreProperties)
MetaStoreProviders.bindForType(
+ HmsClientConfig.METASTORE_TYPE_HMS,
props.getHmsClientProperties(), Collections.emptyMap());
+ HmsClientConfig config = new HmsClientConfig(hms.getConfResources(),
+ HmsConfHelper.mergeCatalogProperties(
+ props.getHmsClientProperties(),
hms.toHiveConfOverrides("")),
Review Comment:
Fixed. Hive and Hudi live HMS client configs now resolve
metastore_client_timeout_second with the legacy FE environment fallback instead
of passing a blank default. Added non-default environment tests.
##########
fe/fe-connector/fe-connector-iceberg/src/main/java/org/apache/doris/connector/iceberg/IcebergConnector.java:
##########
@@ -1248,45 +1277,42 @@ private HadoopAuthenticator pluginAuthenticator() {
}
/**
- * Resolves the plugin-side Kerberos authenticator for the catalog, or
{@code null} for a non-Kerberos
- * catalog. Two Kerberos sources are covered, in precedence order:
- * <ol>
- * <li><b>Storage</b> Kerberos — the raw {@code
hadoop.security.authentication=kerberos} passthrough
- * (HDFS / data-lake login), built from the storage Hadoop
configuration. Unchanged prior behavior;
- * when storage is Kerberos this single login also carries the HMS
metastore RPC (same UGI).</li>
- * <li><b>HMS-metastore</b> Kerberos with non-Kerberos storage — a
secured Hive Metastore whose data
- * storage is simple (e.g. a Kerberized HMS over S3). Legacy fe-core
served this from the fe-core
- * {@code IcebergHMSMetaStoreProperties} HMS authenticator
(delivered via {@code DefaultConnectorContext});
- * once the fe-core iceberg property cluster is deleted the
connector must own it. This mirrors
- * {@code HMSBaseProperties.initHadoopAuthenticator}: the HMS client
principal/keytab facts
- * ({@link HmsMetaStoreProperties#kerberos()}) feed a {@link
KerberosAuthenticationConfig}, so the
- * {@code doAs} logs in the same client identity fe-core used. The
HMS <em>service</em> principal /
- * SASL settings ride the catalog's own HiveConf ({@code
hms.toHiveConfOverrides}), not the login.</li>
- * </ol>
- * Package-visible + static for direct unit testing (mirrors the {@code
metaFailureMessage} helpers).
+ * Resolves only the storage-side Kerberos authenticator used by FileIO.
HMS authentication is intentionally
+ * resolved separately by {@link #buildHmsAuthenticator} and applied at
the client-pool boundary.
*/
static HadoopAuthenticator buildPluginAuthenticator(Map<String, String>
properties,
Map<String, String> storageHadoopConfig) {
if
("kerberos".equalsIgnoreCase(properties.get(HADOOP_SECURITY_AUTHENTICATION))) {
return HadoopAuthenticator.getHadoopAuthenticator(
IcebergCatalogFactory.buildHadoopConfiguration(properties,
storageHadoopConfig));
}
- if
(IcebergCatalogProperties.TYPE_HMS.equals(IcebergCatalogProperties.of(properties).getFlavor()))
{
- HmsMetaStoreProperties hms = (HmsMetaStoreProperties)
MetaStoreProviders.bindForType(
- IcebergCatalogProperties.TYPE_HMS, properties,
storageHadoopConfig);
- Optional<KerberosAuthSpec> spec = hms.kerberos();
- if (spec.isPresent() && spec.get().hasCredentials()) {
- Configuration conf =
-
IcebergCatalogFactory.buildHadoopConfiguration(properties, storageHadoopConfig);
- conf.set("hadoop.security.authentication", "kerberos");
- conf.set("hive.metastore.sasl.enabled", "true");
- return HadoopAuthenticator.getHadoopAuthenticator(
- new
KerberosAuthenticationConfig(spec.get().getPrincipal(), spec.get().getKeytab(),
conf));
- }
- }
return null;
Review Comment:
Fixed. Iceberg now captures its default HMS table owner through
HiveHadoopUtil.currentUser() inside the HMS authenticator while catalog and
FileIO construction remain under storage authentication. Added a mixed-identity
regression.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
