VenuReddy2103 commented on code in PR #6914:
URL: https://github.com/apache/hive/pull/6914#discussion_r4495898961
##########
standalone-metastore/metastore-server/src/main/java/org/apache/hadoop/hive/metastore/ServletSecurity.java:
##########
@@ -522,14 +513,56 @@ static SslContextFactory
createSslContextFactory(Configuration conf) throws IOEx
LOG.info("HTTP Server SSL: SslContextFactory.getExcludeProtocols = {}",
Arrays.toString(factory.getExcludeProtocols()));
}
+ if (includeCipherSuites.length > 0) {
+ factory.setIncludeCipherSuites(includeCipherSuites);
+ }
+ final SecurityUtils.ClientAuth clientAuth = SecurityUtils.getClientAuth(
+ MetastoreConf.getVar(conf, MetastoreConf.ConfVars.SSL_CLIENT_AUTH));
+ if (clientAuth != SecurityUtils.ClientAuth.NONE) {
+ setServerTrustStore(factory, conf);
+ if (clientAuth == SecurityUtils.ClientAuth.NEED) {
+ factory.setNeedClientAuth(true);
+ } else {
+ factory.setWantClientAuth(true);
+ }
+ }
+ LOG.info("HTTP Server SSL: client authentication: {}", clientAuth);
+ return factory;
+ }
+
+ private static void setServerKeyStore(SslContextFactory.Server factory,
Configuration conf) throws IOException {
Review Comment:
Done. The read/validate/default logic now lives in `MetastoreConf`:
`getSslServerKeyStore`, `getSslServerTrustStore`, `getSslClientKeyStore`,
`getSslClientTrustStore` and `getSslClientAuth`, next to the similar
`getZKConfig`. All call sites use them: `HiveMetaStore`, `ServletSecurity`
(Jetty consumes path() / typeOrDefault() / AlgorithmOrDefault()),
`ThriftHiveMetaStoreClient` and `HMSClient`. I put them in `MetastoreConf`
rather than `SecurityUtils` so that `SecurityUtils` stays independent of
`ConfVars`; it never referenced them before, and `MetastoreConf` already
depends on `SecurityUtils.ClientAuth` for the validator. `SecurityUtils` keeps
only the `StoreConfig` and `ClientAuth` types and the socket/context code.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
