[
https://issues.apache.org/jira/browse/HIVE-9934?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14370441#comment-14370441
]
Chao commented on HIVE-9934:
----------------------------
Hi [~thejas], for JDBC, I need to modify the code. In HiveConnection, when
password is empty, it will change it to "anonymous". Since I'm using JDBC +
Beeline to reproduce the issue, I need to change it so that the password will
still remain empty.
For SaslPlainServerFactory, sorry my previous comment wasn't precise. Here,
even though from different packages. they are added via different Providers
with the same key ("SaslServerFactory.PLAIN"). Later, when searching for a
particular key, it always choose the first Provider that matches. Since the
Providers are added in static blocks, the order may not be deterministic.
Hence, if the Hadoop one is picked, security issue could happen.
> Vulnerability in LdapAuthenticationProviderImpl enables HiveServer2 client to
> degrade the authentication mechanism to "none", allowing authentication
> without password
> ----------------------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: HIVE-9934
> URL: https://issues.apache.org/jira/browse/HIVE-9934
> Project: Hive
> Issue Type: Bug
> Components: Security
> Affects Versions: 1.1.0
> Reporter: Chao
> Assignee: Chao
> Fix For: 1.2.0
>
> Attachments: HIVE-9934.1.patch, HIVE-9934.2.patch, HIVE-9934.3.patch,
> HIVE-9934.3.patch
>
>
> Vulnerability in LdapAuthenticationProviderImpl enables HiveServer2 client to
> degrade the authentication mechanism to "none", allowing authentication
> without password.
> See: http://docs.oracle.com/javase/jndi/tutorial/ldap/security/simple.html
> “If you supply an empty string, an empty byte/char array, or null to the
> Context.SECURITY_CREDENTIALS environment property, then the authentication
> mechanism will be "none". This is because the LDAP requires the password to
> be nonempty for simple authentication. The protocol automatically converts
> the authentication to "none" if a password is not supplied.”
>
> Since the LdapAuthenticationProviderImpl.Authenticate method is relying on a
> NamingException being thrown during creation of initial context, it does not
> fail when the context result is an “unauthenticated” positive response from
> the LDAP server. The end result is, one can authenticate with HiveServer2
> using the LdapAuthenticationProviderImpl with only a user name and an empty
> password.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
