Anonymous Coward (940) has posted comments on this change. ( http://gerrit.cloudera.org:8080/24654 )
Change subject: [spark] Add delegation-token support for the Spark connector ...................................................................... Patch Set 3: (2 comments) http://gerrit.cloudera.org:8080/#/c/24654/3/java/kudu-spark/src/main/scala/org/apache/kudu/spark/kudu/KuduDelegationTokenProvider.scala File java/kudu-spark/src/main/scala/org/apache/kudu/spark/kudu/KuduDelegationTokenProvider.scala: http://gerrit.cloudera.org:8080/#/c/24654/3/java/kudu-spark/src/main/scala/org/apache/kudu/spark/kudu/KuduDelegationTokenProvider.scala@49 PS3, Line 49: * `--proxy-user` and no keytab, where the remote driver has no TGT of its own. How does it support `--proxy-user` without Kudu server-side user impersonation capability? Such a feature had been requested in KUDU-3586 http://gerrit.cloudera.org:8080/#/c/24654/3/java/kudu-spark/src/main/scala/org/apache/kudu/spark/kudu/KuduDelegationTokenProvider.scala@102 PS3, Line 102: client.exportAuthenticationCredentials() Suppose the `kinit` uses a superuser keytab with principal `super`, `spark-submit ... --proxy-user tom ...`, what is the owner of the exported credential? I think it's `super`, if so, the normal user `tom` hosts `super`'s credential, it's a kind of privilege escalation -- To view, visit http://gerrit.cloudera.org:8080/24654 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: kudu Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Iacda7b30fd1de3b91301774147bfa8706cefc17f Gerrit-Change-Number: 24654 Gerrit-PatchSet: 3 Gerrit-Owner: Zoltan Chovan <[email protected]> Gerrit-Reviewer: Abhishek Chennaka <[email protected]> Gerrit-Reviewer: Alexey Serbin <[email protected]> Gerrit-Reviewer: Anonymous Coward (940) Gerrit-Reviewer: Ashwani Raina <[email protected]> Gerrit-Reviewer: Attila Bukor <[email protected]> Gerrit-Reviewer: Kudu Jenkins (120) Gerrit-Reviewer: Marton Greber <[email protected]> Gerrit-Reviewer: Zoltan Chovan <[email protected]> Gerrit-Reviewer: Zoltan Martonka <[email protected]> Gerrit-Comment-Date: Mon, 10 Aug 2026 07:16:07 +0000 Gerrit-HasComments: Yes
