jtstorck commented on a change in pull request #3279: NIFI-5984: Enabled
Kerberos Authentication for PutKudu
URL: https://github.com/apache/nifi/pull/3279#discussion_r255635153
##########
File path:
nifi-nar-bundles/nifi-kudu-bundle/nifi-kudu-processors/src/main/java/org/apache/nifi/processors/kudu/PutKudu.java
##########
@@ -206,21 +227,48 @@ public void OnScheduled(final ProcessContext context)
throws KuduException {
flushMode =
SessionConfiguration.FlushMode.valueOf(context.getProperty(FLUSH_MODE).getValue());
getLogger().debug("Setting up Kudu connection...");
- kuduClient = createClient(kuduMasters);
+ final KerberosCredentialsService credentialsService =
context.getProperty(KERBEROS_CREDENTIALS_SERVICE).asControllerService(KerberosCredentialsService.class);
+ kuduClient = createClient(kuduMasters, credentialsService);
kuduTable = kuduClient.openTable(tableName);
getLogger().debug("Kudu connection successfully initialized");
}
- protected KuduClient createClient(final String masters) {
+ protected KuduClient createClient(final String masters, final
KerberosCredentialsService credentialsService) throws LoginException {
+ if (credentialsService == null) {
+ return buildClient(masters);
+ }
+
+ final String keytab = credentialsService.getKeytab();
+ final String principal = credentialsService.getPrincipal();
+ kerberosUser = loginKerberosUser(principal, keytab);
+
+ final KerberosAction<KuduClient> kerberosAction = new
KerberosAction<>(kerberosUser, () -> buildClient(masters), getLogger());
Review comment:
In addition to creating the client with KerberosAction, I would recommend
running the invocations of methods on the created Kudu client with
KerberosAction as well, to make sure the correct Subject is available. We did
the same with the HDFS, Solr, Hive, HBase, etc, processors.
Specific to KerberosAction, you can see an example of that in
`SolrProcessor`'s `onTrigger` method.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
With regards,
Apache Git Services
