VenuReddy2103 commented on code in PR #6914:
URL: https://github.com/apache/hive/pull/6914#discussion_r4495809887
##########
standalone-metastore/metastore-server/src/main/java/org/apache/hadoop/hive/metastore/ServletSecurity.java:
##########
@@ -522,14 +513,56 @@ static SslContextFactory
createSslContextFactory(Configuration conf) throws IOEx
LOG.info("HTTP Server SSL: SslContextFactory.getExcludeProtocols = {}",
Arrays.toString(factory.getExcludeProtocols()));
}
+ if (includeCipherSuites.length > 0) {
+ factory.setIncludeCipherSuites(includeCipherSuites);
+ }
+ final SecurityUtils.ClientAuth clientAuth = SecurityUtils.getClientAuth(
Review Comment:
Good catch. Client authentication is now limited to the Thrift endpoints.
createSslContextFactory takes the client auth mode as a parameter: the Thrift
HTTP server passes metastore.ssl.client.auth, while ServletServerBuilder always
passes NONE, so REST catalog and property servlet clients are never asked for a
certificate and keep authenticating with JWT/OAuth2. The description now says
the setting applies to the Thrift endpoints only. If there's demand for mTLS on
the REST catalog, a separate servlet-level setting could be added in a
follow-up.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
