VenuReddy2103 commented on code in PR #6914:
URL: https://github.com/apache/hive/pull/6914#discussion_r4495842205
##########
standalone-metastore/metastore-common/src/main/java/org/apache/hadoop/hive/metastore/conf/MetastoreConf.java:
##########
@@ -1519,6 +1524,32 @@ public enum ConfVars {
"Comma-separated list of SSL protocols to include for the Metastore."),
SSL_INCLUDE_CIPHERSUITES("metastore.include.ciphersuites",
"hive.metastore.include.ciphersuites", "",
"Colon-separated list of cipher suite names to include for the
Metastore."),
+ SSL_CLIENT_AUTH("metastore.ssl.client.auth",
"hive.metastore.ssl.client.auth",
Review Comment:
Agreed on the semantics. I kept `WANT` as a migration step toward `NEED`
(roll out client certificates, then enforce), and the description now says it
provides no access control on its own. It also states that the client
certificate is only used to accept or reject the TLS connection: its identity
is not mapped to a user or used for authorization, the server still trusts the
user name reported by the client without Kerberos, and Kerberos should be used
to authenticate users. The `metastore.server.truststore.path` description now
recommends containing only the CA that issues the Metastore client certificates
(e.g. an internal CA), not a general-purpose bundle such as the JDK cacerts.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
