Copilot commented on code in PR #11355:
URL: https://github.com/apache/gravitino/pull/11355#discussion_r3353216165
##########
catalogs/hive-metastore-common/src/main/java/org/apache/gravitino/hive/client/HiveClientFactory.java:
##########
@@ -202,6 +212,17 @@ private HiveClient
createHiveClientInternal(HiveClientClassLoader classloader) {
return createProxyHiveClientImpl(
classloader.getHiveVersion(), properties, ugi, classloader);
+ } else if (enableKerberos) {
+ // UGI is a shared class (org.apache.hadoop.* delegated to
baseLoader), so the system CL
+ // and HiveClientClassLoader share the same UGI static state. The TGT
is already stored in
+ // realLoginUgi.subject by kerberosClient.login(). The only thing
needed is to bind that
+ // Subject to the current thread so GSSAPI can find the TGT during the
HMS Thrift handshake.
+ // UGI.doAs() wraps Subject.doAs() internally — same pattern as
ImpalaEngineAdapter.
+ UserGroupInformation realUgi = kerberosClient.getRealLoginUgi();
+ final HiveClientClassLoader.HiveVersion hiveVersion =
classloader.getHiveVersion();
+ return realUgi.doAs(
+ (java.security.PrivilegedExceptionAction<HiveClient>)
+ () -> createHiveClientImpl(hiveVersion, properties,
classloader));
Review Comment:
`kerberosClient.getRealLoginUgi()` is documented/implemented as nullable,
but this branch immediately dereferences it via `realUgi.doAs(...)`. If
`login()` was not invoked (or failed) this will throw a NullPointerException;
it’s safer to fail fast with a clear error.
##########
catalogs/hive-metastore-common/src/main/java/org/apache/gravitino/hive/client/HiveClientFactory.java:
##########
@@ -202,6 +212,17 @@ private HiveClient
createHiveClientInternal(HiveClientClassLoader classloader) {
return createProxyHiveClientImpl(
classloader.getHiveVersion(), properties, ugi, classloader);
+ } else if (enableKerberos) {
+ // UGI is a shared class (org.apache.hadoop.* delegated to
baseLoader), so the system CL
+ // and HiveClientClassLoader share the same UGI static state. The TGT
is already stored in
+ // realLoginUgi.subject by kerberosClient.login(). The only thing
needed is to bind that
+ // Subject to the current thread so GSSAPI can find the TGT during the
HMS Thrift handshake.
+ // UGI.doAs() wraps Subject.doAs() internally — same pattern as
ImpalaEngineAdapter.
+ UserGroupInformation realUgi = kerberosClient.getRealLoginUgi();
+ final HiveClientClassLoader.HiveVersion hiveVersion =
classloader.getHiveVersion();
+ return realUgi.doAs(
+ (java.security.PrivilegedExceptionAction<HiveClient>)
+ () -> createHiveClientImpl(hiveVersion, properties,
classloader));
Review Comment:
This uses a fully qualified type name
(`java.security.PrivilegedExceptionAction`) in the code. The project guidelines
prefer normal imports over FQNs unless there is a real name conflict; please
add an import and use `PrivilegedExceptionAction` here instead.
##########
catalogs/hive-metastore-common/src/main/java/org/apache/gravitino/hive/kerberos/KerberosClient.java:
##########
@@ -198,4 +198,15 @@ public void close() {
public void setHiveClient(HiveClient client) {
this.hiveClient = client;
}
+
+ /**
+ * Returns the real (non-proxy) {@link UserGroupInformation} that was
obtained after Kerberos
+ * login via keytab. Used by callers that need to bind the JAAS Subject to
the current thread
+ * (e.g., via {@code ugi.doAs(...)}) before performing a Kerberos-protected
RPC call.
+ *
+ * @return the real login UGI, or {@code null} if {@link #login()} has not
been called yet.
+ */
+ public UserGroupInformation getRealLoginUgi() {
+ return realLoginUgi;
+ }
Review Comment:
This new public accessor can return null (per Javadoc and current
implementation), but callers (e.g. HiveClientFactory) will typically
dereference the result immediately. Since this method is newly introduced,
consider making it non-null by enforcing that `login()` has been called (fail
fast with a clear exception) and update the Javadoc accordingly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
