[jira] [Commented] (HIVE-21892) Trusted domain authentication should look at X-Forwarded-For header as well

2019-06-19 Thread Jason Dere (JIRA) 


[ 
https://issues.apache.org/jira/browse/HIVE-21892?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16868048#comment-16868048
 ] 

Jason Dere commented on HIVE-21892:
---

+1

> Trusted domain authentication should look at X-Forwarded-For header as well
> ---
>
> Key: HIVE-21892
> URL: https://issues.apache.org/jira/browse/HIVE-21892
> Project: Hive
>  Issue Type: Bug
>Affects Versions: 4.0.0
>Reporter: Prasanth Jayachandran
>Assignee: Prasanth Jayachandran
>Priority: Major
>  Labels: pull-request-available
> Attachments: HIVE-21892.1.patch
>
>  Time Spent: 40m
>  Remaining Estimate: 0h
>
> HIVE-21783 added trusted domain authentication. However, it looks only at 
> request.getRemoteAddr() which works in most cases where there are no 
> intermediate forward/reverse proxies. In trusted domain scenarios, if there 
> intermediate proxies, the proxies typically append its own ip address 
> "X-Forwarded-For" header. The X-Forwarded-For will look like clientIp -> 
> proxyIp1 -> proxyIp2. The left most ip address in the X-Forwarded-For 
> represents the real client ip address. For such scenarios, add a config to 
> optionally look at X-Forwarded-For header when available to determine the 
> real client ip. 



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

[jira] [Commented] (HIVE-21892) Trusted domain authentication should look at X-Forwarded-For header as well

2019-06-19 Thread Ashutosh Bapat (JIRA) 


[ 
https://issues.apache.org/jira/browse/HIVE-21892?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16867463#comment-16867463
 ] 

Ashutosh Bapat commented on HIVE-21892:
---

[~jdere], [~prasanth_j], I have given some cosmetic comments on the PR. I don't 
have any serious concern for this patch. So, once addressing those comments, 
you may commit the patch.

> Trusted domain authentication should look at X-Forwarded-For header as well
> ---
>
> Key: HIVE-21892
> URL: https://issues.apache.org/jira/browse/HIVE-21892
> Project: Hive
>  Issue Type: Bug
>Affects Versions: 4.0.0
>Reporter: Prasanth Jayachandran
>Assignee: Prasanth Jayachandran
>Priority: Major
>  Labels: pull-request-available
> Attachments: HIVE-21892.1.patch
>
>  Time Spent: 40m
>  Remaining Estimate: 0h
>
> HIVE-21783 added trusted domain authentication. However, it looks only at 
> request.getRemoteAddr() which works in most cases where there are no 
> intermediate forward/reverse proxies. In trusted domain scenarios, if there 
> intermediate proxies, the proxies typically append its own ip address 
> "X-Forwarded-For" header. The X-Forwarded-For will look like clientIp -> 
> proxyIp1 -> proxyIp2. The left most ip address in the X-Forwarded-For 
> represents the real client ip address. For such scenarios, add a config to 
> optionally look at X-Forwarded-For header when available to determine the 
> real client ip. 



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

[jira] [Commented] (HIVE-21892) Trusted domain authentication should look at X-Forwarded-For header as well

2019-06-18 Thread Hive QA (JIRA) 


[ 
https://issues.apache.org/jira/browse/HIVE-21892?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16867242#comment-16867242
 ] 

Hive QA commented on HIVE-21892:




Here are the results of testing the latest attachment:
https://issues.apache.org/jira/secure/attachment/12972150/HIVE-21892.1.patch

{color:red}ERROR:{color} -1 due to no test(s) being added or modified.

{color:green}SUCCESS:{color} +1 due to 16168 tests passed

Test results: 
https://builds.apache.org/job/PreCommit-HIVE-Build/17642/testReport
Console output: https://builds.apache.org/job/PreCommit-HIVE-Build/17642/console
Test logs: http://104.198.109.242/logs/PreCommit-HIVE-Build-17642/

Messages:
{noformat}
Executing org.apache.hive.ptest.execution.TestCheckPhase
Executing org.apache.hive.ptest.execution.PrepPhase
Executing org.apache.hive.ptest.execution.YetusPhase
Executing org.apache.hive.ptest.execution.ExecutionPhase
Executing org.apache.hive.ptest.execution.ReportingPhase
{noformat}

This message is automatically generated.

ATTACHMENT ID: 12972150 - PreCommit-HIVE-Build

> Trusted domain authentication should look at X-Forwarded-For header as well
> ---
>
> Key: HIVE-21892
> URL: https://issues.apache.org/jira/browse/HIVE-21892
> Project: Hive
>  Issue Type: Bug
>Affects Versions: 4.0.0
>Reporter: Prasanth Jayachandran
>Assignee: Prasanth Jayachandran
>Priority: Major
> Attachments: HIVE-21892.1.patch
>
>
> HIVE-21783 added trusted domain authentication. However, it looks only at 
> request.getRemoteAddr() which works in most cases where there are no 
> intermediate forward/reverse proxies. In trusted domain scenarios, if there 
> intermediate proxies, the proxies typically append its own ip address 
> "X-Forwarded-For" header. The X-Forwarded-For will look like clientIp -> 
> proxyIp1 -> proxyIp2. The left most ip address in the X-Forwarded-For 
> represents the real client ip address. For such scenarios, add a config to 
> optionally look at X-Forwarded-For header when available to determine the 
> real client ip. 



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

[jira] [Commented] (HIVE-21892) Trusted domain authentication should look at X-Forwarded-For header as well

2019-06-18 Thread Hive QA (JIRA) 


[ 
https://issues.apache.org/jira/browse/HIVE-21892?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16867213#comment-16867213
 ] 

Hive QA commented on HIVE-21892:


| (x) *{color:red}-1 overall{color}* |
\\
\\
|| Vote || Subsystem || Runtime || Comment ||
|| || || || {color:brown} Prechecks {color} ||
| {color:green}+1{color} | {color:green} @author {color} | {color:green}  0m  
0s{color} | {color:green} The patch does not contain any @author tags. {color} |
|| || || || {color:brown} master Compile Tests {color} ||
| {color:blue}0{color} | {color:blue} mvndep {color} | {color:blue}  2m  
3s{color} | {color:blue} Maven dependency ordering for branch {color} |
| {color:green}+1{color} | {color:green} mvninstall {color} | {color:green}  7m 
49s{color} | {color:green} master passed {color} |
| {color:green}+1{color} | {color:green} compile {color} | {color:green}  0m 
44s{color} | {color:green} master passed {color} |
| {color:green}+1{color} | {color:green} checkstyle {color} | {color:green}  0m 
32s{color} | {color:green} master passed {color} |
| {color:blue}0{color} | {color:blue} findbugs {color} | {color:blue}  0m 
37s{color} | {color:blue} common in master has 62 extant Findbugs warnings. 
{color} |
| {color:blue}0{color} | {color:blue} findbugs {color} | {color:blue}  0m 
42s{color} | {color:blue} service in master has 48 extant Findbugs warnings. 
{color} |
| {color:green}+1{color} | {color:green} javadoc {color} | {color:green}  0m 
34s{color} | {color:green} master passed {color} |
|| || || || {color:brown} Patch Compile Tests {color} ||
| {color:blue}0{color} | {color:blue} mvndep {color} | {color:blue}  0m 
29s{color} | {color:blue} Maven dependency ordering for patch {color} |
| {color:green}+1{color} | {color:green} mvninstall {color} | {color:green}  0m 
46s{color} | {color:green} the patch passed {color} |
| {color:green}+1{color} | {color:green} compile {color} | {color:green}  0m 
43s{color} | {color:green} the patch passed {color} |
| {color:green}+1{color} | {color:green} javac {color} | {color:green}  0m 
43s{color} | {color:green} the patch passed {color} |
| {color:red}-1{color} | {color:red} checkstyle {color} | {color:red}  0m 
14s{color} | {color:red} service: The patch generated 2 new + 29 unchanged - 1 
fixed = 31 total (was 30) {color} |
| {color:green}+1{color} | {color:green} whitespace {color} | {color:green}  0m 
 1s{color} | {color:green} The patch has no whitespace issues. {color} |
| {color:green}+1{color} | {color:green} findbugs {color} | {color:green}  1m 
31s{color} | {color:green} the patch passed {color} |
| {color:green}+1{color} | {color:green} javadoc {color} | {color:green}  0m 
33s{color} | {color:green} the patch passed {color} |
|| || || || {color:brown} Other Tests {color} ||
| {color:green}+1{color} | {color:green} asflicense {color} | {color:green}  0m 
16s{color} | {color:green} The patch does not generate ASF License warnings. 
{color} |
| {color:black}{color} | {color:black} {color} | {color:black} 18m 38s{color} | 
{color:black} {color} |
\\
\\
|| Subsystem || Report/Notes ||
| Optional Tests |  asflicense  javac  javadoc  findbugs  checkstyle  compile  |
| uname | Linux hiveptest-server-upstream 3.16.0-4-amd64 #1 SMP Debian 
3.16.43-2+deb8u5 (2017-09-19) x86_64 GNU/Linux |
| Build tool | maven |
| Personality | 
/data/hiveptest/working/yetus_PreCommit-HIVE-Build-17642/dev-support/hive-personality.sh
 |
| git revision | master / 7416fac |
| Default Java | 1.8.0_111 |
| findbugs | v3.0.0 |
| checkstyle | 
http://104.198.109.242/logs//PreCommit-HIVE-Build-17642/yetus/diff-checkstyle-service.txt
 |
| modules | C: common service U: . |
| Console output | 
http://104.198.109.242/logs//PreCommit-HIVE-Build-17642/yetus.txt |
| Powered by | Apache Yetushttp://yetus.apache.org |


This message was automatically generated.



> Trusted domain authentication should look at X-Forwarded-For header as well
> ---
>
> Key: HIVE-21892
> URL: https://issues.apache.org/jira/browse/HIVE-21892
> Project: Hive
>  Issue Type: Bug
>Affects Versions: 4.0.0
>Reporter: Prasanth Jayachandran
>Assignee: Prasanth Jayachandran
>Priority: Major
> Attachments: HIVE-21892.1.patch
>
>
> HIVE-21783 added trusted domain authentication. However, it looks only at 
> request.getRemoteAddr() which works in most cases where there are no 
> intermediate forward/reverse proxies. In trusted domain scenarios, if there 
> intermediate proxies, the proxies typically append its own ip address 
> "X-Forwarded-For" header. The X-Forwarded-For will look like clientIp -> 
> proxyIp1 -> proxyIp2. The left most ip address in the X-Forwarded-For 
> represents the real client ip address. For such scenarios, add a config to 
> optionally look at X-Forwarded-For header when

[jira] [Commented] (HIVE-21892) Trusted domain authentication should look at X-Forwarded-For header as well

2019-06-18 Thread Jason Dere (JIRA) 


[ 
https://issues.apache.org/jira/browse/HIVE-21892?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16867149#comment-16867149
 ] 

Jason Dere commented on HIVE-21892:
---

I think this makes sense. Also cc [~ashutosh.bapat] for feedback

> Trusted domain authentication should look at X-Forwarded-For header as well
> ---
>
> Key: HIVE-21892
> URL: https://issues.apache.org/jira/browse/HIVE-21892
> Project: Hive
>  Issue Type: Bug
>Affects Versions: 4.0.0
>Reporter: Prasanth Jayachandran
>Assignee: Prasanth Jayachandran
>Priority: Major
> Attachments: HIVE-21892.1.patch
>
>
> HIVE-21783 added trusted domain authentication. However, it looks only at 
> request.getRemoteAddr() which works in most cases where there are no 
> intermediate forward/reverse proxies. In trusted domain scenarios, if there 
> intermediate proxies, the proxies typically append its own ip address 
> "X-Forwarded-For" header. The X-Forwarded-For will look like clientIp -> 
> proxyIp1 -> proxyIp2. The left most ip address in the X-Forwarded-For 
> represents the real client ip address. For such scenarios, add a config to 
> optionally look at X-Forwarded-For header when available to determine the 
> real client ip. 



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)