JoegenUSTC opened a new pull request, #11355:
URL: https://github.com/apache/gravitino/pull/11355
### What changes were proposed in this pull request?
This PR fixes three independent bugs in `HiveClientFactory` that together
prevent Hive Metastore
connections from working when Kerberos authentication is enabled and
impersonation is **disabled**.
**Changes:**
1. **`createHiveClientWithBackend()`** – Use
`HiveClientFactory.class.getClassLoader()` as
`baseLoader` instead of `Thread.currentThread().getContextClassLoader()`
(TCCL). TCCL is
unstable across threads; using it causes `UserGroupInformation` to be
loaded by two different
ClassLoaders, making the TGT stored after `login()` invisible at
connection time.
2. **`createHiveClientImpl()`** – Load `HiveVersion` from the isolated
`HiveClientClassLoader`
before calling `getConstructor()`. `HiveClientImpl` is a barrier class
redefined via
`defineClass` inside the isolated ClassLoader; its constructor expects
the `HiveVersion` type
from the isolated ClassLoader scope. Passing the system ClassLoader's
`HiveVersion.class`
causes `NoSuchMethodException`.
3. **`createHiveClientInternal()`** – Add a `realUgi.doAs()` wrapper for the
non-impersonation
Kerberos branch. The JVM default
`javax.security.auth.useSubjectCredsOnly=true` means GSSAPI
only finds credentials in the current thread's JAAS Subject context.
`KerberosClient.login()`
stores the TGT in `realLoginUgi.subject` but does not bind it to the
current thread;
`ugi.doAs()` is required to do so. The impersonation branch already does
this correctly via
`createProxyHiveClientImpl`; this fix brings the non-impersonation path
in line.
Also adds `KerberosClient.getRealLoginUgi()` as the public accessor needed
by fix #3, and adds
`"Cannot find Hive jar directory"` to the Hive2 fallback condition to handle
environments where
HIVE3 libs directory is absent.
### Why are the changes needed?
Without these fixes, any Hive catalog configured with Kerberos
authentication and impersonation
disabled fails to connect to HMS with one or more of:
```
GSS initiate failed
No valid credentials provided (Mechanism level: Failed to find any Kerberos
tgt)
```
```
java.lang.NoSuchMethodException: HiveClientImpl.<init>(HiveVersion,
Properties)
```
All three bugs exist on the same code path and must be fixed together for
the feature to work.
Fix: #11353
### Does this PR introduce _any_ user-facing change?
No API or configuration changes. This is a bug fix for an existing feature
(Kerberos HMS authentication without impersonation) that was silently broken.
### How was this patch tested?
Verified on an internal deployment with a real Kerberos-secured HMS
(non-impersonation mode):
- `GET /api/metalakes/{metalake}/catalogs/{catalog}/schemas` returns schema
list correctly after fix
- `GET /api/metalakes/{metalake}/catalogs/{catalog}/schemas/{schema}/tables`
returns table list correctly after fix
- No `GSSException` or `NoSuchMethodException` in server logs
Unit tests in `hive-metastore-common` all pass (`./gradlew
:catalogs:hive-metastore-common:test -PskipITs`).
Note: a full Kerberos integration test requires a KDC environment which is
not available in
standard CI. A follow-up issue can track adding a Docker-based KDC
integration test.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
