g3rg0 commented on code in PR #4666:
URL: https://github.com/apache/hive/pull/4666#discussion_r1317826787
##########
service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpServlet.java:
##########
@@ -284,7 +283,7 @@ protected void doPost(HttpServletRequest request,
HttpServletResponse response)
}
// Send a 401 to the client
response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
- if(isAuthTypeEnabled(request, HiveAuthConstants.AuthTypes.KERBEROS)) {
+ if(authType.isEnabled(HiveAuthConstants.AuthTypes.KERBEROS)) {
Review Comment:
You are right. I wanted to fix the case where no `Authorization` header is
received and Kerberos authentication is enabled. In this case,
`isAuthTypeEnabled(request, HiveAuthConstants.AuthTypes.KERBEROS)` will always
be false, i.e., a `WWW-Authenticate` header will never be returned in an
[rfc4559 4.1](https://datatracker.ietf.org/doc/html/rfc4559#section-4.1)
compliant manner. (Note: In the current code this works fine, because if the
first allowed auth mode is Kerberos, then the above `isAuthTypeEnabled(...)`
condition will be true.)
Maybe I should add an additional check to the condition that there is no
`Authorization` header in the request. What do you think about this?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
