HyukjinKwon commented on code in PR #58438:
URL: https://github.com/apache/spark/pull/58438#discussion_r3974251894
##########
sql/hive-thriftserver/src/main/scala/org/apache/spark/sql/hive/thriftserver/HiveThriftServer2.scala:
##########
@@ -105,6 +107,28 @@ object HiveThriftServer2 extends Logging {
}
}
+ // Sessions are impersonated for metastore calls, but queries run as the
service identity
+ // (SPARK-5159), so storage ACLs are checked against the wrong principal.
Auth types that never
+ // establish a user identity have nothing to impersonate, so they are exempt.
+ private[thriftserver] def warnIfIneffectiveDoAs(hiveConf: HiveConf): Unit = {
+ val authType = hiveConf.getVar(ConfVars.HIVE_SERVER2_AUTHENTICATION)
+ val unverifiedAuthTypes = Seq(AuthTypes.NONE,
AuthTypes.NOSASL).map(_.getAuthName)
+ // Constant on the left: authType is null when explicitly set empty, and
this must not NPE.
+ val authVerifiesUser =
!unverifiedAuthTypes.exists(_.equalsIgnoreCase(authType))
+ if (authVerifiesUser &&
hiveConf.getBoolVar(ConfVars.HIVE_SERVER2_ENABLE_DOAS)) {
+ logWarning(log"${MDC(CONFIG, ConfVars.HIVE_SERVER2_ENABLE_DOAS.varname)}
is set to true, " +
Review Comment:
Warn-only is the right call for a maintenance branch -- it surfaces the
SPARK-5159 impersonation gap without breaking servers that are running today,
and pointing at the 5.0 escape hatch (`allowIneffectiveDoAs`) in the message is
a nice touch. One fix: the PR description still answers the user-facing-change
question with "Explicit error unless config flag is disabled" (copied from
#58414), but this variant only logs a warning and never fails startup -- please
update it so the 4.x behavior isn't misread as a hard failure.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
