Переглянути джерело

HUE-1928 [beeswax] HiveServer2 supports pass-through LDAP authentication

Add an optional LDAP password ini property for the hue user.
The username of the hue user should come from the keberos ticket.
Added test to check open session with HS2 in regular mode and with
LDAP passthrough
Romain Rigaux 11 роки тому
батько
коміт
5d377ac79b

+ 4 - 0
apps/beeswax/src/beeswax/server/hive_server2_lib.py

@@ -21,6 +21,7 @@ import re
 from operator import itemgetter
 
 from desktop.lib import thrift_util
+from desktop.conf import LDAP_PASSWORD
 from hadoop import cluster
 
 from TCLIService import TCLIService
@@ -356,6 +357,9 @@ class HiveServerClient:
 
     if self.query_server['server_name'] == 'beeswax': # All the time
       kwargs['configuration'].update({'hive.server2.proxy.user': user.username})
+      if LDAP_PASSWORD.get(): # HiveServer2 supports pass-through LDAP authentication.
+        kwargs['username'] = 'hue'
+        kwargs['password'] = LDAP_PASSWORD.get()
 
     req = TOpenSessionReq(**kwargs)
     res = self._client.OpenSession(req)

+ 44 - 0
apps/beeswax/src/beeswax/tests.py

@@ -40,6 +40,8 @@ from desktop.lib.django_test_util import make_logged_in_client, assert_equal_mod
 from desktop.lib.test_utils import grant_access, add_to_group
 from desktop.lib.security_util import get_localhost_name
 
+import desktop.conf as desktop_conf
+
 import beeswax.create_table
 import beeswax.hive_site
 import beeswax.models
@@ -1750,6 +1752,48 @@ def test_hiveserver2_get_security():
       hive_site._HIVE_SITE_DICT.pop(hive_site._CNF_HIVESERVER2_AUTHENTICATION, None)
 
 
+class MockClient():
+
+  def __init__(self):
+    self.open_session_args= None
+
+  def OpenSession(self, args):
+    self.open_session_args = args
+
+
+def test_hive_server2_open_session():
+  make_logged_in_client()
+  user = User.objects.get(username='test')
+
+  query_server = get_query_server_config()
+
+  db_client = HiveServerClient(query_server, user)
+  mock_hs2_client = MockClient()
+  setattr(db_client, '_client', mock_hs2_client)
+
+  # Regular session
+  try:
+    db_client.open_session(user)
+  except:
+    pass
+  finally:
+    req = mock_hs2_client.open_session_args
+    assert_equal('hue', req.username)
+    assert_equal(None, req.password)
+
+  # LDAP credentials
+  finish = desktop_conf.LDAP_PASSWORD.set_for_testing('I_love_Hue')
+  try:
+    db_client.open_session(user)
+  except:
+    pass
+  finally:
+    finish()
+    req = mock_hs2_client.open_session_args
+    assert_equal('hue', req.username)
+    assert_equal('I_love_Hue', req.password)
+
+
 def test_metastore_security():
   tmpdir = tempfile.mkdtemp()
   saved = None

+ 3 - 0
desktop/conf.dist/hue.ini

@@ -56,6 +56,9 @@
   # Filename of SSL RSA Private Key
   ## ssl_private_key=
 
+  # LDAP password of the hue user used for LDAP authentications. For example for LDAP Authentication with HiveServer2.
+  # ldap_password=
+
   # Default encoding for site data
   ## default_site_encoding=utf-8
 

+ 3 - 0
desktop/conf/pseudo-distributed.ini.tmpl

@@ -65,6 +65,9 @@
   # Filename of SSL RSA Private Key
   ## ssl_private_key=
 
+  # LDAP password of the hue user used for LDAP authentications. For example for LDAP Authentication with HiveServer2.
+  # ldap_password=
+
   # Default encoding for site data
   ## default_site_encoding=utf-8
 

+ 8 - 0
desktop/core/src/desktop/conf.py

@@ -75,6 +75,12 @@ SSL_CIPHER_LIST = Config(
   help=_("List of allowed and disallowed ciphers"),
   default="DEFAULT:!aNULL:!eNULL:!LOW:!EXPORT:!SSLv2")
 
+LDAP_PASSWORD = Config(
+  key="ldap_password",
+  help=_("LDAP password of the hue user used for LDAP authentications. For example for LDAP Authentication with HiveServer2."),
+  private=True,
+  default=None)
+
 ENABLE_SERVER = Config(
   key="enable_server",
   help=_("If set to false, runcpserver will not actually start the web server.  Used if Apache is being used as a WSGI container."),
@@ -333,6 +339,7 @@ SERVER_USER = Config(
   help=_("Username to run servers as."),
   type=str,
   default="hue")
+
 SERVER_GROUP = Config(
   key="server_group",
   help=_("Group to run servers as."),
@@ -509,6 +516,7 @@ LOCAL_FILESYSTEMS = UnspecifiedConfigSection(
                   required=True,
                   help=_("The path on the local filesystem.")))))
 
+
 def default_feedback_url():
   """A version-specific URL."""
   return "http://groups.google.com/a/cloudera.org/group/hue-user"