[
https://issues.apache.org/jira/browse/IMPALA-5552?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16769946#comment-16769946
]
ASF subversion and git services commented on IMPALA-5552:
---------------------------------------------------------
Commit b8e995e042619c6062cfa970b21924508e16677d in impala's branch
refs/heads/2.x from Fredy Wijaya
[ https://gitbox.apache.org/repos/asf?p=impala.git;h=b8e995e ]
IMPALA-5552: Add support for authorized proxy groups
The patch adds support for mapping of users to a list of proxy groups.
The following flags are added in impalad:
- authorized_proxy_group_config
- authorized_proxy_group_config_delimiter
Example:
--authorized_proxy_group_config=hue=group1,group2;user1=*
This feature is not supported on Shell-based Hadoop groups mapping
providers.
The authorized_proxy_user/group_config parser will now strip leading
and trailing whitespaces from the user/group names.
Testing:
- Added FE unit test to check for groups mapping provider
- Added BE unit test for the parsing logic
- Added a new test in test_authorization.py
- Ran all end-to-end test_authorization.py
Change-Id: I6953f89c293b06b72f523b11802232133d9d6cbb
Reviewed-on: http://gerrit.cloudera.org:8080/10510
Tested-by: Impala Public Jenkins <[email protected]>
Reviewed-by: Tim Armstrong <[email protected]>
> Proxy user list should support groups
> -------------------------------------
>
> Key: IMPALA-5552
> URL: https://issues.apache.org/jira/browse/IMPALA-5552
> Project: IMPALA
> Issue Type: Improvement
> Components: Frontend
> Reporter: Tristan Stevens
> Assignee: Fredy Wijaya
> Priority: Critical
> Fix For: Impala 2.13.0, Impala 3.1.0
>
>
> The authorized_proxy_user_config takes a map of user->doAsUser* - i.e. user
> is allowed to impersonate any users in the list of doAsUsers.
> For enterprise deployments, this would be better specified as a list of
> groups, rather than a a list of users:
> user1->group*
> When accepting a query, Impala will check that the doAs user is a member of
> any of the list of groups specified for the connecting user.
> HiveServer2 does this via Hadoop-level proxy user privileges (e.g.
> {{<property>
> <name>hadoop.proxyuser.user1.hosts</name>
> <value>doAsUser1,doAsUser2</value>
> </property>
> <property>
> <name>hadoop.proxyuser.user1.groups</name>
> <value>doAsGroup1,doAsGroup2</value>
> </property>}}
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
