Explorar o código

HUE-8949 [catalog] Add kerberos support to Atlas

Jean-Francois Desjeans Gauthier %!s(int64=6) %!d(string=hai) anos
pai
achega
d5e9460c8a

+ 3 - 0
desktop/conf.dist/hue.ini

@@ -2034,6 +2034,9 @@
     # search results.
     ## search_cluster=
 
+    # Set to true when authenticating via kerberos instead of username/password
+    ## kerberos_enabled=core_site.is_kerberos_enabled()
+
   # Deprecated by [[catalog]]
   [[navigator]]
     # Navigator API URL (without version suffix).

+ 3 - 0
desktop/conf/pseudo-distributed.ini.tmpl

@@ -2023,6 +2023,9 @@
     # search results.
     ## search_cluster=
 
+    # Set to true when authenticating via kerberos instead of username/password
+    ## kerberos_enabled=core_site.is_kerberos_enabled()
+
   # Deprecated by [[catalog]]
   [[navigator]]
     # Navigator API URL (without version suffix).

+ 9 - 7
desktop/libs/metadata/src/metadata/catalog/atlas_client.py

@@ -23,10 +23,9 @@ import re
 from django.utils.translation import ugettext as _
 
 from desktop.lib.rest import resource
-from desktop.lib.rest.unsecure_http_client import UnsecureHttpClient
-from desktop.lib.rest.http_client import RestException
+from desktop.lib.rest.http_client import HttpClient, RestException
 
-from metadata.conf import CATALOG, get_catalog_auth_password, get_catalog_search_cluster
+from metadata.conf import CATALOG, get_catalog_search_cluster
 from metadata.catalog.base import CatalogAuthException, CatalogApiException, CatalogEntityDoesNotExistException, Api
 
 LOG = logging.getLogger(__name__)
@@ -63,11 +62,14 @@ class AtlasApi(Api):
 
     self._api_url = CATALOG.API_URL.get().strip('/')
     self._username = CATALOG.SERVER_USER.get()
-    self._password = get_catalog_auth_password()
+    self._password = CATALOG.SERVER_PASSWORD.get()
+
+    self._client = HttpClient(self._api_url, logger=LOG)
+    if CATALOG.KERBEROS_ENABLED.get():
+      self._client.set_kerberos_auth()
+    elif self._password:
+      self._client.set_basic_auth(self._username, self._password)
 
-    # Navigator does not support Kerberos authentication while other components usually requires it
-    self._client = UnsecureHttpClient(self._api_url, logger=LOG)
-    self._client.set_basic_auth(self._username, self._password)
     self._root = resource.Resource(self._client, urlencode=False) # For search_entities_interactive
 
     self.__headers = {}

+ 20 - 11
desktop/libs/metadata/src/metadata/conf.py

@@ -25,12 +25,13 @@ from desktop.conf import AUTH_USERNAME as DEFAULT_AUTH_USERNAME, CLUSTER_ID as D
 from desktop.lib.conf import Config, ConfigSection, coerce_bool, coerce_password_from_script
 from desktop.lib.paths import get_config_root
 
+from hadoop.core_site import is_kerberos_enabled
+
 from metadata.settings import DJANGO_APPS
 
 
 OPTIMIZER_AUTH_PASSWORD = None
 NAVIGATOR_AUTH_PASSWORD = None
-CATALOG_AUTH_PASSWORD = None
 
 LOG = logging.getLogger(__name__)
 
@@ -228,7 +229,7 @@ def get_catalog_url():
 
 def has_catalog(user):
   from desktop.auth.backend import is_admin
-  return ((bool(get_catalog_url() and get_catalog_auth_password())) or has_navigator(user)) \
+  return ((bool(get_catalog_url())) or has_navigator(user)) \
       and (is_admin(user) or user.has_hue_permission(action="access", app=DJANGO_APPS[0]))
 
 def has_readonly_catalog(user):
@@ -237,17 +238,13 @@ def has_readonly_catalog(user):
 def get_catalog_search_cluster():
   return CATALOG.SEARCH_CLUSTER.get()
 
-def get_catalog_auth_password():
-  '''Get the password to authenticate with.'''
-  global CATALOG_AUTH_PASSWORD
+def get_kerberos_enabled_default():
+  '''Use core-site is_kerberos_enabled'''
+  return is_kerberos_enabled()
 
-  if CATALOG_AUTH_PASSWORD is None:
-    try:
-      CATALOG_AUTH_PASSWORD = CATALOG.SERVER_PASSWORD.get()
-    except CalledProcessError:
-      LOG.exception('Could not read Catalog password file, need to restart Hue to re-enable it.')
+def get_catalog_server_password_script():
+  return CATALOG.SERVER_PASSWORD_SCRIPT.get()
 
-  return CATALOG_AUTH_PASSWORD
 
 CATALOG = ConfigSection(
   key='catalog',
@@ -269,6 +266,12 @@ CATALOG = ConfigSection(
       key="server_password",
       help=_t("Password of the user used for authentication."),
       private=True,
+      dynamic_default=get_catalog_server_password_script),
+    SERVER_PASSWORD_SCRIPT=Config(
+      key="server_password_script",
+      help=_t("Execute this script to produce the server password secret. This will be used when `server_password` is not set."),
+      private=True,
+      type=coerce_password_from_script,
       default=None),
     SEARCH_CLUSTER=Config(
       key="search_cluster",
@@ -280,6 +283,12 @@ CATALOG = ConfigSection(
       default=25,
       type=int
     ),
+    KERBEROS_ENABLED=Config(
+      key="kerberos_enabled",
+      help=_t("Set to true when authenticating via kerberos instead of username/password"),
+      type=coerce_bool,
+      dynamic_default=get_kerberos_enabled_default
+    )
   )
 )