VenuReddy2103 commented on code in PR #6914:
URL: https://github.com/apache/hive/pull/6914#discussion_r4495809887
##########
standalone-metastore/metastore-server/src/main/java/org/apache/hadoop/hive/metastore/ServletSecurity.java:
##########
@@ -522,14 +513,56 @@ static SslContextFactory
createSslContextFactory(Configuration conf) throws IOEx
LOG.info("HTTP Server SSL: SslContextFactory.getExcludeProtocols = {}",
Arrays.toString(factory.getExcludeProtocols()));
}
+ if (includeCipherSuites.length > 0) {
+ factory.setIncludeCipherSuites(includeCipherSuites);
+ }
+ final SecurityUtils.ClientAuth clientAuth = SecurityUtils.getClientAuth(
Review Comment:
Good catch. Client authentication is now limited to the Thrift endpoints.
`createSslContextFactory` takes the client auth mode as a parameter: the Thrift
HTTP server passes `metastore.ssl.client.auth`, while `ServletServerBuilder`
always passes `NONE`, so REST catalog and property servlet clients are never
asked for a certificate and keep authenticating with JWT/OAuth2. The
description now says the setting applies to the Thrift endpoints only. If
there's demand for mTLS on the REST catalog, a separate servlet-level setting
could be added in a follow-up.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
