[
https://issues.apache.org/jira/browse/IMPALA-10027?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17261700#comment-17261700
]
ASF subversion and git services commented on IMPALA-10027:
----------------------------------------------------------
Commit ab6b7960db3181096134b8aa46cb90baff6df006 in impala's branch
refs/heads/master from Tim Armstrong
[ https://gitbox.apache.org/repos/asf?p=impala.git;h=ab6b796 ]
IMPALA-10027: configurable default anonymous user
A username can be determined for a session via two mechanisms:
* In a secure env, the user is authenticated by LDAP or Kerberos
* In an unsecure env, the client specifies the user name, either
as a parameter to the OpenSession API (HS2) or as a parameter
to the first query run (beeswax)
This patch affects what happens if neither of the above mechanisms
is used. Previously we would end up with the username being an
empty string, but this makes Ranger unhappy. Hive uses the name
"anonymous" in this situation, so we change Impala's behaviour too.
This is configurable by -anonymous_user_name. -anonymous_user_name=
reverts to the old behaviour.
Test
* Add an end-to-end test that exercises this via impala-shell for
HS2, HS2-HTTP and beeswax protocols.
* Tweak a couple of existing tests that depended on the previous
behavior.
Change-Id: I6db491231fa22484aed476062b8fe4c8f69130b0
Reviewed-on: http://gerrit.cloudera.org:8080/16902
Reviewed-by: Impala Public Jenkins <[email protected]>
Tested-by: Impala Public Jenkins <[email protected]>
> Use anonymous user when user is not specified
> ---------------------------------------------
>
> Key: IMPALA-10027
> URL: https://issues.apache.org/jira/browse/IMPALA-10027
> Project: IMPALA
> Issue Type: Improvement
> Components: Frontend, Security
> Affects Versions: Impala 4.0
> Reporter: Tamas Mate
> Priority: Major
> Labels: ramp-up
> Fix For: Impala 4.0
>
>
> When Ranger is enabled with no further authentication method configured and
> no user specified Impala throws IllegalArgumentException (see bellow).
> Meanwhile, Hive JDBC replaces empty user with 'anonymous'. Although, without
> authentication any user can be impersonated and it is a rare use-case, we
> should consider substitute empty username for 'anonymous' as well for
> interoperability.
>
> {noformat}
> $ impala-shell --protocol='hs2-http' -i <hostname> --user '' -q 'describe
> tarmstrong.test'
> Starting Impala Shell without Kerberos authentication
> Warning: live_progress only applies to interactive shell sessions, and is
> being skipped for now.
> Warning: --connect_timeout_ms is currently ignored with HTTP transport.
> Opened TCP connection to
> coordinator-IBM-Think1.env-hg4zgx.apps.os4demo.cloudera.com:80
> Connected to coordinator-IBM-Think1.env-hg4zgx.apps.os4demo.cloudera.com:80
> Server version: impalad version 4.0.0-SNAPSHOT RELEASE (build
> e21fdec10f2f90d1ff6dab619d4dcb5626f458a8)
> Query: describe tarmstrong.test
> ERROR: IllegalArgumentException: Null user
> Could not execute command: describe tarmstrong.test
> Traceback (most recent call last):
> File "/home/tarmstrong/.local/bin/impala-shell", line 11, in <module>
> sys.exit(impala_shell_main())
> File
> "/home/tarmstrong/.local/lib/python2.7/site-packages/impala_shell/impala_shell.py",
> line 1874, in impala_shell_main
> raise FatalShellException()
> impala_shell.impala_shell.FatalShellException
> {noformat}
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
