Browse Source

HUE-9183 [impala] Update hue to use kerberos principal to communicate with impala when either webserver_require_spnego or is_kerberos_enabled flag is on

Weixia 5 years ago
parent
commit
c8f3b208b3

+ 7 - 1
apps/impala/src/impala/conf.py

@@ -28,7 +28,7 @@ from desktop.lib.conf import ConfigSection, Config, coerce_bool, coerce_csv, coe
 from desktop.lib.exceptions import StructuredThriftTransportException
 from desktop.lib.paths import get_desktop_root
 
-from impala.impala_flags import get_max_result_cache_size, is_impersonation_enabled, is_kerberos_enabled
+from impala.impala_flags import get_max_result_cache_size, is_impersonation_enabled, is_kerberos_enabled, is_webserver_spnego_required
 from impala.settings import NICE_NAME
 
 
@@ -58,6 +58,12 @@ IMPERSONATION_ENABLED=Config(
   type=coerce_bool,
   dynamic_default=is_impersonation_enabled)
 
+WEBSERVER_SPNEGO_REQUIRED=Config(
+  key='webserver_require_spnego',
+  help=_t("Turn on/off spnego-kerberos authentication for http web consoles when communicate with Impala."),
+  type=coerce_bool,
+  dynamic_default=is_webserver_spnego_required)
+
 QUERYCACHE_ROWS=Config(
   key='querycache_rows',
   help=_t("Number of initial rows of a resultset to ask Impala to cache in order to"

+ 8 - 0
apps/impala/src/impala/impala_flags.py

@@ -24,6 +24,7 @@ LOG = logging.getLogger(__name__)
 _IMPALA_FLAGS = None
 
 _WEBSERVER_CERTIFICATE_FILE = '-webserver_certificate_file'
+_WEBSERVER_REQUIRE_SPNEGO = '-webserver_require_spnego'
 _SSL_SERVER_CERTIFICATE = '-ssl_server_certificate'
 _MAX_RESULT_CACHE_SIZE = '-max_result_cache_size'
 _AUTHORIZED_PROXY_USER_CONFIG = '-authorized_proxy_user_config'
@@ -94,6 +95,13 @@ def is_transactional():
 def is_kerberos_enabled():
   return get_conf().get(_PRINCIPAL) is not None
 
+def is_webserver_spnego_required():
+  """
+     Returns True if Enable Kerberos Authentication for HTTP Web-Consoles for Impala service is turned on (default: true)
+     -webserver_require_spnego=true  in impalad_flags
+   """
+  return get_conf().get(_WEBSERVER_REQUIRE_SPNEGO)
+
 def _parse_impala_flags():
   from impala import conf # Cyclic dependency
   global _IMPALA_FLAGS

+ 6 - 2
apps/impala/src/impala/server.py

@@ -27,7 +27,7 @@ from beeswax.server.dbms import QueryServerException
 from beeswax.server.hive_server2_lib import HiveServerClient
 
 from ImpalaService import ImpalaHiveServer2Service
-from impala.impala_flags import get_webserver_certificate_file
+from impala.impala_flags import get_webserver_certificate_file, is_webserver_spnego_required, is_kerberos_enabled
 from impala.conf import DAEMON_API_USERNAME, DAEMON_API_PASSWORD
 
 
@@ -137,9 +137,13 @@ class ImpalaDaemonApi(object):
       self._client.set_digest_auth(DAEMON_API_USERNAME.get(), DAEMON_API_PASSWORD.get())
 
     self._root = Resource(self._client)
-    self._security_enabled = False
+    self._security_enabled = is_kerberos_enabled
+    self._webserver_spnego_required = is_webserver_spnego_required()
     self._thread_local = threading.local()
 
+    # Authorized with Kerberos principal when either _security_enabled or _webserver_spnego_required is true
+    if self._webserver_spnego_required or self._security_enabled:
+      self._client.set_kerberos_auth()
 
   def __str__(self):
     return "ImpalaDaemonApi at %s" % self._url