This is an automated email from the ASF dual-hosted git repository. chengpan pushed a commit to branch branch-1.5 in repository https://gitbox.apache.org/repos/asf/incubator-kyuubi.git
commit 21ca7540c7699315a16dfdd8854a312c4d64d7ef Author: jiaoqingbo <[email protected]> AuthorDate: Thu Mar 17 19:12:54 2022 +0800 [KYUUBI #2156] Change log to reflect exactly why getting token failed ### _Why are the changes needed?_ fix #2156 ### _How was this patch tested?_ - [ ] Add some test cases that check the changes thoroughly including negative and positive cases if possible - [ ] Add screenshots for manual tests if appropriate - [x] [Run test](https://kyuubi.apache.org/docs/latest/develop_tools/testing.html#running-tests) locally before make a pull request Closes #2157 from jiaoqingbo/2156. Closes #2156 96a22e59 [jiaoqingbo] add link to doc dc11a214 [jiaoqingbo] [KYUUBI #2156] Change log to reflect exactly why getting token failed Authored-by: jiaoqingbo <[email protected]> Signed-off-by: Cheng Pan <[email protected]> --- docs/security/hadoop_credentials_manager.md | 13 +++++++++++++ .../kyuubi/credentials/HadoopCredentialsManager.scala | 6 +++++- 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/docs/security/hadoop_credentials_manager.md b/docs/security/hadoop_credentials_manager.md index 32ce02e..6bc6be6 100644 --- a/docs/security/hadoop_credentials_manager.md +++ b/docs/security/hadoop_credentials_manager.md @@ -75,3 +75,16 @@ kyuubi\.credentials<br>\.hadoopfs\.uris|<div style='width: 65pt;word-wrap: break kyuubi\.credentials<br>\.hive\.enabled|<div style='width: 65pt;word-wrap: break-word;white-space: normal'>true</div>|<div style='width: 170pt;word-wrap: break-word;white-space: normal'>Whether to renew Hive metastore delegation token</div>|<div style='width: 30pt'>boolean</div>|<div style='width: 20pt'>1.4.0</div> kyuubi\.credentials<br>\.renewal\.interval|<div style='width: 65pt;word-wrap: break-word;white-space: normal'>PT1H</div>|<div style='width: 170pt;word-wrap: break-word;white-space: normal'>How often Kyuubi renews one user's delegation tokens</div>|<div style='width: 30pt'>duration</div>|<div style='width: 20pt'>1.4.0</div> kyuubi\.credentials<br>\.renewal\.retry\.wait|<div style='width: 65pt;word-wrap: break-word;white-space: normal'>PT1M</div>|<div style='width: 170pt;word-wrap: break-word;white-space: normal'>How long to wait before retrying to fetch new credentials after a failure.</div>|<div style='width: 30pt'>duration</div>|<div style='width: 20pt'>1.4.0</div> + + +### Required Security Configs + +The necessary configurations for hdfs and hive to obtain delegation token are as follows: + +Key | Meaning | value +--- | --- | --- +<div style='width: 40pt;word-wrap: break-word;white-space: normal'>hadoop.security.authentication</div>|<div style='width: 40pt;word-wrap: break-word;white-space: normal'>Set the authentication for the cluster</div>|<div style='width: 40pt;word-wrap: break-word;white-space: normal'>kerberos</div> +<div style='width: 40pt;word-wrap: break-word;white-space: normal'>hive.metastore.uris</div>|<div style='width: 40pt;word-wrap: break-word;white-space: normal'>URI for client to contact metastore server</div>|<div style='width: 40pt;word-wrap: break-word;white-space: normal'>thrift://{metastoreHost}:{metastorePort}}</div> +<div style='width: 40pt;word-wrap: break-word;white-space: normal'>hive.metastore.sasl.enabled</div>|<div style='width: 40pt;word-wrap: break-word;white-space: normal'>If true, the metastore thrift interface will be secured with SASL.Clients must authenticate with Kerberos.</div>|<div style='width: 40pt;word-wrap: break-word;white-space: normal'>true</div> +<div style='width: 40pt;word-wrap: break-word;white-space: normal'>hive.metastore.kerberos.principal</div>|<div style='width: 40pt;word-wrap: break-word;white-space: normal'>The service principal for the metastore thrift server. The special string _HOST will be replaced automatically with the correct host name.</div>|<div style='width: 40pt;word-wrap: break-word;white-space: normal'>for example hive/_HOST@${realm}</div> +<div style='width: 40pt;word-wrap: break-word;white-space: normal'>hive.metastore.kerberos.keytab.file</div>|<div style='width: 40pt;word-wrap: break-word;white-space: normal'>The path to the Kerberos Keytab file containing the metastore thrift server's service principal.</div>|<div style='width: 40pt;word-wrap: break-word;white-space: normal'>for example /etc/security/keytabs/hive.service.keytab</div> \ No newline at end of file diff --git a/kyuubi-server/src/main/scala/org/apache/kyuubi/credentials/HadoopCredentialsManager.scala b/kyuubi-server/src/main/scala/org/apache/kyuubi/credentials/HadoopCredentialsManager.scala index 2ebda60..fafa655 100644 --- a/kyuubi-server/src/main/scala/org/apache/kyuubi/credentials/HadoopCredentialsManager.scala +++ b/kyuubi-server/src/main/scala/org/apache/kyuubi/credentials/HadoopCredentialsManager.scala @@ -100,7 +100,11 @@ class HadoopCredentialsManager private (name: String) extends AbstractService(na val required = provider.delegationTokensRequired() if (!required) { warn(s"Service ${provider.serviceName} does not require a token." + - s" Check your configuration to see if security is disabled or not.") + s" Check your configuration to see if security is disabled or not." + + s" If security is enabled, some configurations of ${provider.serviceName} " + + s" might be missing, please check the configurations in " + + s" https://kyuubi.readthedocs.io/en/latest/security"; + + s"/hadoop_credentials_manager.html#required-security-configs") provider.close() } required
