[
https://issues.apache.org/jira/browse/HIVE-19276?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Yuxiang Chen updated HIVE-19276:
--------------------------------
Description:
Metastore does not set the token signature by default in the metastore (returns
an empty string), and thus the service field, which is assigned to the value of
token signature, would also be empty. This would cause problem that the clients
cannot retrieve the right token from the token file, using this service field.
Metastore delegation tokens currently return an empty string in the delegation
token for the "service" field. The service field should be set to something
that meaningfully identifies the metastore/cluster, so clients can find it in
the token file.
Meanwhile, we also want to change the code on hive metastore to use metastore
uris as the service field when token signature is empty. However, to make the
changes effective, we also need to do similar modifications on the client side,
as we mentioned above.
Thus to do this, we need to add the following logic:
(1) On the client side, the client will first try to get token using the
current service field, if it gets nothing, we fallback to use
"hive.metastore.uris" as the service field and retry token selection.
(2) On the metastore side, if the current token signature is not empty, we set
the service field to be the value of token signature; otherwise, we use
hive.metastore.uris as the service field.
was:
Metastore does not set the token signature by default in the metastore (returns
an empty string), and thus the service field, which is assigned to the value of
token signature, would also be empty. This would cause problem that the clients
cannot retrieve the right token from the token file, using this service field.
Metastore delegation tokens currently return an empty string in the delegation
token for the "service" field. The service field should be set to something
that meaningfully identifies the metastore/cluster, so clients can find it in
the token file.
Meanwhile, we also want to change the code on hive metastore to use metastore
uris as the service field when token signature is empty. However, to make the
changes effective, we also need to do similar modifications on the client side,
as we mentioned above.
Thus to do this, we need to add the following logic:
(1) On the client side, the client will first try to get token using the
current service field, if it gets nothing, we fallback to use
"hive.metastore.uris" as the service field and retry token selection.
(2) On the metastore side, if the current token signature is not empty, we set
the service field to be the value of token signature; otherwise, we use
hive.metastore.uris as the service field.
The patch is in the attachment.
> Metastore delegation tokens should return non-empty service field in
> delegation tokens
> --------------------------------------------------------------------------------------
>
> Key: HIVE-19276
> URL: https://issues.apache.org/jira/browse/HIVE-19276
> Project: Hive
> Issue Type: Task
> Components: Hive
> Reporter: Yuxiang Chen
> Assignee: Yuxiang Chen
> Priority: Major
>
> Metastore does not set the token signature by default in the metastore
> (returns an empty string), and thus the service field, which is assigned to
> the value of token signature, would also be empty. This would cause problem
> that the clients cannot retrieve the right token from the token file, using
> this service field.
> Metastore delegation tokens currently return an empty string in the
> delegation token for the "service" field. The service field should be set to
> something that meaningfully identifies the metastore/cluster, so clients can
> find it in the token file.
> Meanwhile, we also want to change the code on hive metastore to use metastore
> uris as the service field when token signature is empty. However, to make the
> changes effective, we also need to do similar modifications on the client
> side, as we mentioned above.
> Thus to do this, we need to add the following logic:
> (1) On the client side, the client will first try to get token using the
> current service field, if it gets nothing, we fallback to use
> "hive.metastore.uris" as the service field and retry token selection.
> (2) On the metastore side, if the current token signature is not empty, we
> set the service field to be the value of token signature; otherwise, we use
> hive.metastore.uris as the service field.
>
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
