VenuReddy2103 commented on code in PR #6914:
URL: https://github.com/apache/hive/pull/6914#discussion_r4495793540
##########
standalone-metastore/metastore-common/src/main/java/org/apache/hadoop/hive/metastore/utils/SecurityUtils.java:
##########
@@ -367,17 +415,25 @@ public static TServerSocket getServerSSLSocket(String
hiveHost, int portNum, Str
includeProtocols));
LOG.info("SSL Server Socket Enabled Protocols: "
+ Arrays.toString(sslServerSocket.getEnabledProtocols()));
+ setClientAuth(sslServerSocket, clientAuth);
}
return thriftServerSocket;
}
+ private static void setClientAuth(SSLServerSocket sslServerSocket,
ClientAuth clientAuth) {
Review Comment:
Added `TestMetastoreMutualTls`, which starts the Metastore with TLS and
connects with HiveMetaStoreClient, parameterized over the binary and HTTP
transports:
- NONE: clients with and without a certificate are accepted
- WANT: clients with and without a certificate are accepted
- NEED: a client with a trusted certificate is accepted; a client without a
certificate and a client with an untrusted certificate are rejected
- WANT/NEED without metastore.server.truststore.path fail at startup, also
when the client-side metastore.truststore.path is set (so it is never used as a
fallback)
- an invalid mode is rejected with a clear message
I looked at reusing the existing stores, but they only contain server
material: `HMSTestBase` uses a single self-signed pair, and the _data/files_
JKS stores are outside the standalone metastore and expired in 2016. So I added
PKCS12 stores with separate server, client and untrusted-client certificates
under metastore-_server/src/test/resources_, valid until 2036. The keytool
commands to regenerate them are in the class javadoc.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
