sohurdc opened a new pull request, #9340: URL: https://github.com/apache/paimon/pull/9340
Fixes #9337 (https://github.com/apache/paimon/issues/9337) ## What does this PR do? When querying a Paimon table from Hive via HiveServer2 with a Kerberos proxy user (`hive.server2.proxy.user`), the query fails with: ``` UnsupportedOperationException: Proxy user is not supported ``` This happens because `KerberosLoginProvider` throws unconditionally when the current `UserGroupInformation` has auth method `PROXY`, both in `isLoginPossible()` and `doLogin()`. Unlike Spark/Flink, Hive cannot pass a keytab directly — HiveServer2 itself holds the Kerberos credentials and proxies requests on behalf of the business user. In this case, Paimon should simply skip its own Kerberos login and let the existing proxy credentials work. ## Changes This fix targets the scenario where a Paimon table is read from Hive via HiveServer2 with a Kerberos proxy user (`hive.server2.proxy.user`). - `isLoginPossible()`: proxy user now returns `true` instead of throwing `UnsupportedOperationException`. - `doLogin()`: proxy user branch skips login (credentials already provided by the proxy mechanism) instead of throwing. - Remove the now-unreachable private method `throwProxyUserNotSupported()`. - Update `KerberosLoginProviderITCase` to reflect the new behavior: - `isLoginPossibleMustReturnTrueWithProxyUser` (was: `mustThrowException`) - `doLoginMustDoNothingWithProxyUser` (was: `mustThrowException`) ## Verifying this change Run the existing ITCase: ```bash mvn test -pl paimon-common -Dtest=KerberosLoginProviderITCase ``` Manual verification: after rebuilding the Hive connector, a Hive query via HiveServer2 proxy user on a Paimon table returns results normally. Ranger authorization still works as expected (proxy user must still have the required privileges). ## Does this PR introduce any user-facing change? Yes. Hive queries on Paimon tables via HiveServer2 Kerberos proxy user no longer fail with `UnsupportedOperationException`. ## Does this PR introduce any breaking change? No. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
