pan3793 commented on code in PR #7431:
URL: https://github.com/apache/kyuubi/pull/7431#discussion_r3474544835
##########
externals/kyuubi-data-agent-engine/src/main/java/org/apache/kyuubi/engine/dataagent/provider/chatcompletion/ChatCompletionProvider.java:
##########
@@ -118,18 +118,46 @@ private static DataSource attachJdbcDataSource(
if (jdbcUrl == null) {
return null;
}
- LOG.info("Data Agent JDBC URL configured ({})",
jdbcUrl.replaceAll("//.*@", "//<redacted>@"));
-
- String sessionUser =
- ConfUtils.optionalString(conf,
KyuubiReservedKeys.KYUUBI_SESSION_USER_KEY());
+ JdbcDialect dialect = JdbcDialect.fromUrl(jdbcUrl);
+ if (dialect == null) {
+ throw new IllegalArgumentException(
+ "Invalid " + KyuubiConf.ENGINE_DATA_AGENT_JDBC_URL().key());
+ }
+ LOG.info("Data Agent JDBC datasource configured ({})",
dialect.datasourceName());
+
+ // For Kyuubi/HiveServer2 backends, pass the session user for proxy-user
impersonation —
+ // but only when the URL does not already carry explicit credentials,
because URL-supplied
+ // credentials should win (some users pass credentials via session
variables).
+ String subprotocol = JdbcDialect.extractSubprotocol(jdbcUrl);
+ boolean isKyuubiBackend = "kyuubi".equals(subprotocol) ||
"hive2".equals(subprotocol);
+ String hikariUser = null;
+ if (isKyuubiBackend && !hasKyuubiUrlCredentials(jdbcUrl)) {
+ hikariUser = ConfUtils.optionalString(conf,
KyuubiReservedKeys.KYUUBI_SESSION_USER_KEY());
+ }
- DataSource ds = DataSourceFactory.create(jdbcUrl, sessionUser);
+ DataSource ds = DataSourceFactory.create(jdbcUrl, hikariUser);
Review Comment:
many AI apps run agents/tools in a sandbox, maybe we need to design a
sandbox approach in the future, for example, run the data agent process in a
container
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
