Gabriel39 opened a new pull request, #69247: URL: https://github.com/apache/doris/pull/69247
### What problem does this PR solve? Problem Summary: Queries against Kerberos-protected Paimon storage can fail with `Failed to find latest snapshot id` and `Client cannot authenticate via: [TOKEN, KERBEROS]`. Resolving a Table under authentication does not cover snapshot I/O performed after the resolver returns. In addition, storage configured with `hdfs.authentication.*` can initialize without a plugin-side Kerberos authenticator because the selection checks only the raw legacy Hadoop key. Authenticate actual snapshot-cache loads, partition-cache key loads, and the complete time-travel resolution. Reuse the metadata-read wrapper and select the storage authenticator from the effective Hadoop configuration, including normalized storage properties. HMS and storage identities remain separate; cache behavior and empty-table snapshot semantics are preserved. ### Release note Fix Kerberos-authenticated Paimon snapshot reads and recognize normalized HDFS authentication settings when selecting the plugin storage identity. ### Check List (For Author) - [x] Unit Test - [x] Regression test - [x] Manual test - Behavior changed: authenticated Paimon metadata reads retain the storage identity through deferred file I/O. - Documentation needed: No; no configuration key or public API added. Validation: - Reproduced 11 snapshot authentication scenarios before the fix. Added a negative authentication/cache recovery control; all 12 pass after the fix. - Reproduced the normalized-storage-authenticator assertion failure before fixing the legacy-only gate. - Paimon module `install` with `Paimon*` tests: 823 tests, zero failures/errors, one skipped live-connectivity test. Checkstyle and plugin packaging passed. - Local KDC/HMS/HDFS using the original failing DEBUG/ASAN runtime: both Paimon cases failed at the first snapshot read before the patch. Replacing the Paimon plugin with the built artifact made both local suites pass (two suites, zero failed/fatal/skipped), including all four Kerberos HMS property variants, JNI/native reads, incremental reads, time travel, system tables, and the added REFRESH assertion. - Local adaptations replace endpoints/keytab paths and exclude unrelated object-store variants. The migration fixture has matching columns and four rows, created as local Paimon tables; it does not reproduce the original Hive-migrated physical files. - Ten concurrent FE plans across two Kerberos identities succeeded; a mismatched keytab was rejected. A separate intermittent BE credential error observed with a warm backend is not claimed fixed here; the final SQL run used a fresh backend. ### Check List (For Reviewer who merge this PR) - [ ] Confirm the release note - [ ] Confirm test cases - [ ] Confirm document - [ ] Add branch pick label -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
