[
https://issues.apache.org/jira/browse/IMPALA-5552?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Fredy Wijaya resolved IMPALA-5552.
----------------------------------
Resolution: Fixed
Fix Version/s: Impala 3.1.0
Impala 2.13.0
> Proxy user list should support groups
> -------------------------------------
>
> Key: IMPALA-5552
> URL: https://issues.apache.org/jira/browse/IMPALA-5552
> Project: IMPALA
> Issue Type: Improvement
> Components: Frontend
> Reporter: Tristan Stevens
> Assignee: Fredy Wijaya
> Priority: Critical
> Fix For: Impala 2.13.0, Impala 3.1.0
>
>
> The authorized_proxy_user_config takes a map of user->doAsUser* - i.e. user
> is allowed to impersonate any users in the list of doAsUsers.
> For enterprise deployments, this would be better specified as a list of
> groups, rather than a a list of users:
> user1->group*
> When accepting a query, Impala will check that the doAs user is a member of
> any of the list of groups specified for the connecting user.
> HiveServer2 does this via Hadoop-level proxy user privileges (e.g.
> {{<property>
> <name>hadoop.proxyuser.user1.hosts</name>
> <value>doAsUser1,doAsUser2</value>
> </property>
> <property>
> <name>hadoop.proxyuser.user1.groups</name>
> <value>doAsGroup1,doAsGroup2</value>
> </property>}}
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
