ShubhamChaurasia commented on a change in pull request #1418:
URL: https://github.com/apache/hive/pull/1418#discussion_r479982596
##########
File path:
llap-server/src/java/org/apache/hadoop/hive/llap/daemon/impl/ContainerRunnerImpl.java
##########
@@ -342,6 +352,33 @@ public SubmitWorkResponseProto
submitWork(SubmitWorkRequestProto request) throws
.build();
}
+ // if request is coming from llap external client, verify the JWT
+ // as of now, JWT contains applicationId
Review comment:
added a comment in code which explains this -
In GenericUDTFGetSplits
// 6. Generate JWT for external clients if it's a cloud deployment
// we inject extClientAppId in JWT which is same as what fragment
contains.
// extClientAppId in JWT and in fragment are compared on LLAP when a
fragment is submitted.
// see method ContainerRunnerImpl#verifyJwtForExternalClient
In ContainerRunnerImpl#verifyJwtForExternalClient
// extClientAppId is injected in JWT and fragment request by initial
get_splits() call.
// so both of these - extClientAppIdFromJwt and
extClientAppIdFromSplit should be equal eventually if the signed JWT is valid
for this request.
// In get_splits, this extClientAppId is obtained via
LlapCoordinator#createExtClientAppId which generates a
// application Id to be used by external clients.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
