Browse Source

HUE-9183 [impala] communicate securely with Impala when webserver_require_spnego or is_kerberos_enabled is on

Weixia 5 years ago
parent
commit
32ead86c2f

+ 1 - 7
apps/impala/src/impala/conf.py

@@ -28,7 +28,7 @@ from desktop.lib.conf import ConfigSection, Config, coerce_bool, coerce_csv, coe
 from desktop.lib.exceptions import StructuredThriftTransportException
 from desktop.lib.exceptions import StructuredThriftTransportException
 from desktop.lib.paths import get_desktop_root
 from desktop.lib.paths import get_desktop_root
 
 
-from impala.impala_flags import get_max_result_cache_size, is_impersonation_enabled, is_kerberos_enabled, is_webserver_spnego_required
+from impala.impala_flags import get_max_result_cache_size, is_impersonation_enabled, is_kerberos_enabled, is_webserver_spnego_enabled
 from impala.settings import NICE_NAME
 from impala.settings import NICE_NAME
 
 
 
 
@@ -58,12 +58,6 @@ IMPERSONATION_ENABLED=Config(
   type=coerce_bool,
   type=coerce_bool,
   dynamic_default=is_impersonation_enabled)
   dynamic_default=is_impersonation_enabled)
 
 
-WEBSERVER_SPNEGO_REQUIRED=Config(
-  key='webserver_require_spnego',
-  help=_t("Turn on/off spnego-kerberos authentication for http web consoles when communicate with Impala."),
-  type=coerce_bool,
-  dynamic_default=is_webserver_spnego_required)
-
 QUERYCACHE_ROWS=Config(
 QUERYCACHE_ROWS=Config(
   key='querycache_rows',
   key='querycache_rows',
   help=_t("Number of initial rows of a resultset to ask Impala to cache in order to"
   help=_t("Number of initial rows of a resultset to ask Impala to cache in order to"

+ 3 - 3
apps/impala/src/impala/impala_flags.py

@@ -95,10 +95,10 @@ def is_transactional():
 def is_kerberos_enabled():
 def is_kerberos_enabled():
   return get_conf().get(_PRINCIPAL) is not None
   return get_conf().get(_PRINCIPAL) is not None
 
 
-def is_webserver_spnego_required():
+def is_webserver_spnego_enabled():
   """
   """
-     Returns True if Enable Kerberos Authentication for HTTP Web-Consoles for Impala service is turned on (default: true)
-     -webserver_require_spnego=true  in impalad_flags
+    Returns True if Enable Kerberos Authentication for HTTP Web-Consoles for Impala service is turned on (default: true)
+    -webserver_require_spnego=true  in impalad_flags
    """
    """
   return get_conf().get(_WEBSERVER_REQUIRE_SPNEGO)
   return get_conf().get(_WEBSERVER_REQUIRE_SPNEGO)
 
 

+ 9 - 8
apps/impala/src/impala/server.py

@@ -27,7 +27,7 @@ from beeswax.server.dbms import QueryServerException
 from beeswax.server.hive_server2_lib import HiveServerClient
 from beeswax.server.hive_server2_lib import HiveServerClient
 
 
 from ImpalaService import ImpalaHiveServer2Service
 from ImpalaService import ImpalaHiveServer2Service
-from impala.impala_flags import get_webserver_certificate_file, is_webserver_spnego_required, is_kerberos_enabled
+from impala.impala_flags import get_webserver_certificate_file, is_webserver_spnego_enabled, is_kerberos_enabled
 from impala.conf import DAEMON_API_USERNAME, DAEMON_API_PASSWORD
 from impala.conf import DAEMON_API_USERNAME, DAEMON_API_PASSWORD
 
 
 
 
@@ -132,18 +132,19 @@ class ImpalaDaemonApi(object):
   def __init__(self, server_url):
   def __init__(self, server_url):
     self._url = server_url
     self._url = server_url
     self._client = HttpClient(self._url, logger=LOG)
     self._client = HttpClient(self._url, logger=LOG)
+    self._root = Resource(self._client)
+    self._security_enabled = is_kerberos_enabled()
+    self._webserver_spnego_enabled = is_webserver_spnego_enabled()
+    self._thread_local = threading.local()
+
     # You can set username/password for Impala Web UI which overrides kerberos
     # You can set username/password for Impala Web UI which overrides kerberos
     if DAEMON_API_USERNAME.get() is not None and DAEMON_API_PASSWORD.get() is not None:
     if DAEMON_API_USERNAME.get() is not None and DAEMON_API_PASSWORD.get() is not None:
       self._client.set_digest_auth(DAEMON_API_USERNAME.get(), DAEMON_API_PASSWORD.get())
       self._client.set_digest_auth(DAEMON_API_USERNAME.get(), DAEMON_API_PASSWORD.get())
+      LOG.info('Using username and password for authentication')
 
 
-    self._root = Resource(self._client)
-    self._security_enabled = is_kerberos_enabled
-    self._webserver_spnego_required = is_webserver_spnego_required()
-    self._thread_local = threading.local()
-
-    # Authorized with Kerberos principal when either _security_enabled or _webserver_spnego_required is true
-    if self._webserver_spnego_required or self._security_enabled:
+    elif self._webserver_spnego_enabled or self._security_enabled:
       self._client.set_kerberos_auth()
       self._client.set_kerberos_auth()
+      LOG.info('Using kerberos principal for authentication')
 
 
   def __str__(self):
   def __str__(self):
     return "ImpalaDaemonApi at %s" % self._url
     return "ImpalaDaemonApi at %s" % self._url

+ 90 - 2
apps/impala/src/impala/server_tests.py

@@ -52,7 +52,7 @@ class TestImpalaDaemonApi():
           server = ImpalaDaemonApi('localhost')
           server = ImpalaDaemonApi('localhost')
 
 
           server._client.set_digest_auth.assert_called()
           server._client.set_digest_auth.assert_called()
-          server._client.set_kerberos_auth().assert_not_called()
+          server._client.set_kerberos_auth.assert_not_called()
 
 
     with patch('impala.server.DAEMON_API_USERNAME.get') as DAEMON_API_USERNAME_get:
     with patch('impala.server.DAEMON_API_USERNAME.get') as DAEMON_API_USERNAME_get:
       with patch('impala.server.DAEMON_API_PASSWORD.get') as DAEMON_API_PASSWORD_get:
       with patch('impala.server.DAEMON_API_PASSWORD.get') as DAEMON_API_PASSWORD_get:
@@ -63,4 +63,92 @@ class TestImpalaDaemonApi():
           server = ImpalaDaemonApi('localhost')
           server = ImpalaDaemonApi('localhost')
 
 
           server._client.set_digest_auth.assert_not_called()
           server._client.set_digest_auth.assert_not_called()
-          server._client.set_kerberos_auth().assert_not_called()
+          server._client.set_kerberos_auth.assert_not_called()
+
+  def test_kerberos_auth(self):
+
+    with patch('impala.server.DAEMON_API_USERNAME.get') as DAEMON_API_USERNAME_get:
+      with patch('impala.server.DAEMON_API_PASSWORD.get') as DAEMON_API_PASSWORD_get:
+        with patch('impala.server.HttpClient') as HttpClient:
+          with patch('impala.server.is_webserver_spnego_enabled') as is_webserver_spnego_enabled:
+
+            DAEMON_API_USERNAME_get.return_value = 'impala'
+            DAEMON_API_PASSWORD_get.return_value = 'impala'
+            is_webserver_spnego_enabled.return_value = True
+
+            server = ImpalaDaemonApi('localhost')
+
+            server._client.set_digest_auth.assert_called()
+            server._client.set_kerberos_auth.assert_not_called()
+
+    with patch('impala.server.DAEMON_API_USERNAME.get') as DAEMON_API_USERNAME_get:
+      with patch('impala.server.DAEMON_API_PASSWORD.get') as DAEMON_API_PASSWORD_get:
+        with patch('impala.server.HttpClient') as HttpClient:
+          with patch('impala.server.is_webserver_spnego_enabled') as is_webserver_spnego_enabled:
+
+
+            DAEMON_API_USERNAME_get.return_value = None
+            DAEMON_API_PASSWORD_get.return_value = 'impala'
+            is_webserver_spnego_enabled.return_value = False
+
+            server = ImpalaDaemonApi('localhost')
+
+            server._client.set_digest_auth.assert_not_called()
+            server._client.set_kerberos_auth.assert_not_called()
+
+    with patch('impala.server.DAEMON_API_USERNAME.get') as DAEMON_API_USERNAME_get:
+      with patch('impala.server.DAEMON_API_PASSWORD.get') as DAEMON_API_PASSWORD_get:
+        with patch('impala.server.HttpClient') as HttpClient:
+          with patch('impala.server.is_kerberos_enabled') as is_kerberos_enabled:
+            DAEMON_API_USERNAME_get.return_value = None
+            DAEMON_API_PASSWORD_get.return_value = None
+            is_kerberos_enabled.return_value = True
+
+            server = ImpalaDaemonApi('localhost')
+
+            server._client.set_digest_auth.assert_not_called()
+            server._client.set_kerberos_auth.assert_called()
+
+    with patch('impala.server.DAEMON_API_USERNAME.get') as DAEMON_API_USERNAME_get:
+      with patch('impala.server.DAEMON_API_PASSWORD.get') as DAEMON_API_PASSWORD_get:
+        with patch('impala.server.HttpClient') as HttpClient:
+          with patch('impala.server.is_webserver_spnego_enabled') as is_webserver_spnego_enabled:
+
+            DAEMON_API_USERNAME_get.return_value = None
+            DAEMON_API_PASSWORD_get.return_value = None
+            is_webserver_spnego_enabled.return_value = True
+
+            server = ImpalaDaemonApi('localhost')
+
+            server._client.set_digest_auth.assert_not_called()
+            server._client.set_kerberos_auth.assert_called()
+
+    with patch('impala.server.DAEMON_API_USERNAME.get') as DAEMON_API_USERNAME_get:
+      with patch('impala.server.DAEMON_API_PASSWORD.get') as DAEMON_API_PASSWORD_get:
+        with patch('impala.server.HttpClient') as HttpClient:
+          with patch('impala.server.is_kerberos_enabled') as is_kerberos_enabled:
+            with patch('impala.server.is_webserver_spnego_enabled') as is_webserver_spnego_enabled:
+              DAEMON_API_USERNAME_get.return_value = None
+              DAEMON_API_PASSWORD_get.return_value = None
+              is_kerberos_enabled.return_value = False
+              is_webserver_spnego_enabled.return_value = False
+
+              server = ImpalaDaemonApi('localhost')
+
+              server._client.set_digest_auth.assert_not_called()
+              server._client.set_kerberos_auth.assert_not_called()
+
+    with patch('impala.server.DAEMON_API_USERNAME.get') as DAEMON_API_USERNAME_get:
+      with patch('impala.server.DAEMON_API_PASSWORD.get') as DAEMON_API_PASSWORD_get:
+        with patch('impala.server.HttpClient') as HttpClient:
+          with patch('impala.server.is_kerberos_enabled') as is_kerberos_enabled:
+            with patch('impala.server.is_webserver_spnego_enabled') as is_webserver_spnego_enabled:
+              DAEMON_API_USERNAME_get.return_value = None
+              DAEMON_API_PASSWORD_get.return_value = None
+              is_kerberos_enabled.return_value = True
+              is_webserver_spnego_enabled.return_value = True
+
+              server = ImpalaDaemonApi('localhost')
+
+              server._client.set_digest_auth.assert_not_called()
+              server._client.set_kerberos_auth.assert_called()