brightwon opened a new pull request, #3864: URL: https://github.com/apache/iceberg-python/pull/3864
Closes #3787 # Rationale for this change The Hive catalog derives the Kerberos SASL `host` (the hostname component of the service principal) from the metastore URI, with no way to override it. Authentication therefore fails whenever the service principal's hostname component differs from the host being connected to, for example in an HA setup where `uri` has to list the real metastore hosts while the principal uses a single fixed hostname. This adds an optional `hive.kerberos-service-host` property, mirroring the existing `hive.kerberos-service-name` for the `service` component. When it is not set, the URI host is used, so existing behavior is unchanged. ## Are these changes tested? Yes. - `test_create_hive_client_with_kerberos_service_host` verifies the property is passed through to `_HiveClient`. - `test_kerberized_client_uses_configured_service_host` verifies at the transport level that the SASL host is the configured value, and falls back to the URI host when the property is not set. - The existing `_create_hive_client` assertions were updated for the new argument. I also verified it end-to-end against a Hive Metastore with Kerberos: without the property the connection fails with a KDC `LOOKING_UP_SERVER` error, and with it the correct service ticket is issued and the catalog works. ## Are there any user-facing changes? Yes, a new optional Hive catalog property `hive.kerberos-service-host`. It defaults to the metastore URI host, so there is no change for existing users. The documentation table has been updated. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
