Эх сурвалжийг харах

HUE-1505 [impala] Impersonation support

If turned on in the app with impersonation_enabled=True, open a session with:
{
 'username': kerberos_principal_short_name, # hue
 'configuration': {'impala.proxy.user': user.username}
}
Romain Rigaux 12 жил өмнө
parent
commit
d9ce59f7f4

+ 3 - 1
apps/beeswax/src/beeswax/server/dbms.py

@@ -50,13 +50,15 @@ def get(user, query_server=None):
 
 def get_query_server_config(name='beeswax'):
   if name == 'impala':
-    from impala.conf import SERVER_HOST as IMPALA_SERVER_HOST, SERVER_PORT as IMPALA_SERVER_PORT, IMPALA_PRINCIPAL
+    from impala.conf import SERVER_HOST as IMPALA_SERVER_HOST, SERVER_PORT as IMPALA_SERVER_PORT, \
+        IMPALA_PRINCIPAL, IMPERSONATION_ENABLED
 
     query_server = {
         'server_name': 'impala',
         'server_host': IMPALA_SERVER_HOST.get(),
         'server_port': IMPALA_SERVER_PORT.get(),
         'principal': IMPALA_PRINCIPAL.get(),
+        'impersonation_enabled': IMPERSONATION_ENABLED.get()
     }
   else:
     kerberos_principal = hive_site.get_hiveserver2_kerberos_principal(HIVE_SERVER_HOST.get())

+ 13 - 9
apps/beeswax/src/beeswax/server/hive_server2_lib.py

@@ -258,11 +258,11 @@ class HiveServerClient:
     self.query_server = query_server
     self.user = user
 
-    use_sasl, mechanism, kerberos_principal_short_name, hiveserver2_impersonation_enabled = HiveServerClient.get_security(query_server)
-    LOG.info('use_sasl=%s, mechanism=%s, kerberos_principal_short_name=%s, hiveserver2_impersonation_enabled=%s' % (
-             use_sasl, mechanism, kerberos_principal_short_name, hiveserver2_impersonation_enabled))
+    use_sasl, mechanism, kerberos_principal_short_name, impersonation_enabled = HiveServerClient.get_security(query_server)
+    LOG.info('use_sasl=%s, mechanism=%s, kerberos_principal_short_name=%s, impersonation_enabled=%s' % (
+             use_sasl, mechanism, kerberos_principal_short_name, impersonation_enabled))
 
-    self.hiveserver2_impersonation_enabled = hiveserver2_impersonation_enabled
+    self.impersonation_enabled = impersonation_enabled
     self._client = thrift_util.get_client(TCLIService.Client,
                                           query_server['server_host'],
                                           query_server['server_port'],
@@ -277,12 +277,13 @@ class HiveServerClient:
   @classmethod
   def get_security(cls, query_server):
     principal = query_server['principal']
-    hiveserver2_impersonation_enabled = False # Specific to HiveServer2 protocol only
+    impersonation_enabled = False
 
     if query_server['server_name'] == 'impala':
       cluster_conf = cluster.get_cluster_conf_for_job_submission()
       use_sasl = cluster_conf is not None and cluster_conf.SECURITY_ENABLED.get()
       mechanism = HiveServerClient.HS2_MECHANISMS['KERBEROS']
+      impersonation_enabled = query_server['impersonation_enabled']
     else:
       hive_mechanism = hive_site.get_hiveserver2_authentication()
       if hive_mechanism not in HiveServerClient.HS2_MECHANISMS:
@@ -291,20 +292,23 @@ class HiveServerClient:
       mechanism = 'NOSASL'
       if use_sasl:
         mechanism = HiveServerClient.HS2_MECHANISMS[hive_mechanism]
-      hiveserver2_impersonation_enabled = hive_site.hiveserver2_impersonation_enabled()
+      impersonation_enabled = hive_site.hiveserver2_impersonation_enabled()
 
     if principal:
       kerberos_principal_short_name = principal.split('/', 1)[0]
     else:
       kerberos_principal_short_name = None
 
-    return use_sasl, mechanism, kerberos_principal_short_name, hiveserver2_impersonation_enabled
+    return use_sasl, mechanism, kerberos_principal_short_name, impersonation_enabled
 
 
   def open_session(self, user):
-    if self.hiveserver2_impersonation_enabled:
+    if self.impersonation_enabled:
       kerberos_principal_short_name = KERBEROS.HUE_PRINCIPAL.get().split('/', 1)[0]
-      kwargs = {'username': kerberos_principal_short_name, 'configuration': {'hive.server2.proxy.user': user.username}}
+      if self.query_server['server_name'] == 'impala':
+        kwargs = {'username': kerberos_principal_short_name, 'configuration': {'impala.proxy.user': user.username}}
+      else:
+        kwargs = {'username': kerberos_principal_short_name, 'configuration': {'hive.server2.proxy.user': user.username}}
     else:
       kwargs = {'username': user.username, 'configuration': {}}
 

+ 7 - 1
apps/impala/src/impala/conf.py

@@ -19,7 +19,7 @@ import sys
 import socket
 
 from django.utils.translation import ugettext_lazy as _t, ugettext as _
-from desktop.lib.conf import Config
+from desktop.lib.conf import Config, coerce_bool
 
 from impala.settings import NICE_NAME
 
@@ -41,6 +41,12 @@ IMPALA_PRINCIPAL=Config(
   type=str,
   default="impala/%s" % socket.getfqdn())
 
+IMPERSONATION_ENABLED=Config(
+  key='impersonation_enabled',
+  help=_t("Turn on/off impersonation mechanism when talking to Impala."),
+  type=coerce_bool,
+  default=False)
+
 
 def config_validator(user):
   # dbms is dependent on beeswax.conf (this file)

+ 3 - 0
desktop/conf.dist/hue.ini

@@ -453,6 +453,9 @@
   # Kerberos principal
   ## impala_principal=impala/hostname.foo.com
 
+  # Turn on/off impersonation mechanism when talking to Impala
+  ## impersonation_enabled=False
+
 
 ###########################################################################
 # Settings to configure Hbase

+ 3 - 0
desktop/conf/pseudo-distributed.ini.tmpl

@@ -457,6 +457,9 @@
   # Kerberos principal
   ## impala_principal=impala/hostname.foo.com
 
+  # Turn on/off impersonation mechanism when talking to Impala
+  ## impersonation_enabled=False
+
 
 ###########################################################################
 # Settings to configure Hbase