Gabriel39 commented on code in PR #66890:
URL: https://github.com/apache/doris/pull/66890#discussion_r3805521018
##########
fe/fe-connector/fe-connector-hms/src/main/java/org/apache/doris/connector/hms/HmsConfHelper.java:
##########
@@ -58,21 +82,95 @@ public static HiveConf createHiveConf(Map<String, String>
properties) {
// (fixes SecurityUtil.<clinit>) but cannot fix this conf-cached CL.
Pinning here keeps the whole
// hive-metastore class graph in one loader.
hiveConf.setClassLoader(HmsConfHelper.class.getClassLoader());
+ addConfResources(hiveConf, confResources);
for (Map.Entry<String, String> entry : properties.entrySet()) {
+ // A blank username was ignored by the legacy copy-if-present
path; preserving a resource value (or
+ // the "hadoop" default) avoids createRemoteUser("") failing
before the first HMS RPC.
+ if ("hadoop.username".equals(entry.getKey()) &&
isBlank(entry.getValue())) {
+ continue;
+ }
hiveConf.set(entry.getKey(), entry.getValue());
}
// A kerberized HMS requires SASL transport on the metastore Thrift
connection. The legacy fe-core
// HMSBaseProperties.initHadoopAuthenticator auto-enabled
hive.metastore.sasl.enabled whenever the
// metastore/hadoop auth was kerberos; preserve that here so a catalog
that only declares kerberos auth
// (without an explicit hive.metastore.sasl.enabled) still negotiates
SASL, instead of opening a plain
// TSocket that a kerberized metastore drops with TTransportException.
- if
("kerberos".equalsIgnoreCase(properties.get("hadoop.security.authentication"))
- ||
"kerberos".equalsIgnoreCase(properties.get("hive.metastore.authentication.type")))
{
+ String hmsAuthType =
properties.get("hive.metastore.authentication.type");
+ boolean explicitSimple = "simple".equalsIgnoreCase(hmsAuthType);
+ if (explicitSimple) {
+ // The explicit HMS mode is authoritative even when a base
hive-site.xml enables SASL.
+ hiveConf.set("hive.metastore.sasl.enabled", "false");
+ } else if ("kerberos".equalsIgnoreCase(hmsAuthType)
+ || (!explicitSimple
+ &&
"kerberos".equalsIgnoreCase(properties.get("hadoop.security.authentication"))))
{
hiveConf.set("hive.metastore.sasl.enabled", "true");
}
return hiveConf;
}
+ /**
+ * Creates the lightweight Hadoop configuration used only for UGI
resolution.
+ */
+ public static Configuration createHadoopConfWithResources(String
confResources,
+ Map<String, String> properties) {
+ Configuration conf = new Configuration();
+ conf.setClassLoader(HmsConfHelper.class.getClassLoader());
+ addConfResources(conf, confResources);
+ for (Map.Entry<String, String> entry : properties.entrySet()) {
+ if ("hadoop.username".equals(entry.getKey()) &&
isBlank(entry.getValue())) {
+ continue;
+ }
+ conf.set(entry.getKey(), entry.getValue());
+ }
+ return conf;
+ }
+
+ /**
+ * Preserves connector-agnostic passthrough keys while applying canonical
HMS overrides last.
+ */
+ public static Map<String, String> mergeCatalogProperties(Map<String,
String> raw,
+ Map<String, String> overrides) {
+ Map<String, String> merged = new LinkedHashMap<>(raw);
+ // Canonical parsing deliberately omits a blank username; remove the
raw value so it cannot reappear
+ // merely because the HMS client also preserves unrelated custom
configuration keys.
+ if (isBlank(merged.get("hadoop.username"))) {
+ merged.remove("hadoop.username");
+ }
+ merged.putAll(overrides);
+ return merged;
+ }
+
+ private static void addConfResources(Configuration conf, String
confResources) {
+ if (isBlank(confResources)) {
+ return;
+ }
+ String baseDir = resolveHadoopConfigDir();
+ for (String resource : confResources.split(",")) {
+ File file = new File(baseDir, resource.trim());
+ if (!file.isFile()) {
+ throw new IllegalArgumentException("Config resource file does
not exist: " + file);
+ }
+ conf.addResource(new Path(file.toURI()));
+ }
+ }
+
+ private static String resolveHadoopConfigDir() {
+ String configured = System.getProperty("doris.hadoop.config.dir");
Review Comment:
Fixed. DefaultConnectorContext now forwards Config.hadoop_config_dir, and
Hive/Hudi initialize the shared resource-directory bridge in their constructors
before any HMS configuration or authenticator lookup. Added first-access tests
with the system property initially unset.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
