Explorar el Código

HUE-8467 [jobbrowser] Support impala digest auth for queries

Chris Conner hace 7 años
padre
commit
fc7f416

+ 20 - 0
apps/impala/src/impala/conf.py

@@ -180,6 +180,26 @@ AUTH_PASSWORD_SCRIPT = Config(
   type=coerce_password_from_script,
   default=None)
 
+DAEMON_API_PASSWORD = Config(
+  key="daemon_api_password",
+  help=_t("Password for Impala Daemon when username/password authentication is enabled for the Impala Daemon UI."),
+  private=True,
+  default=None)
+
+DAEMON_API_PASSWORD_SCRIPT = Config(
+  key="daemon_api_password_script",
+  help=_t("Execute this script to produce the Impala Daemon Password. This will be used when `daemon_api_password` is not set."),
+  private=True,
+  type=coerce_password_from_script,
+  default=None)
+
+DAEMON_API_USERNAME = Config(
+  key="daemon_api_username",
+  help=_t("Username for Impala Daemon when username/password authentication is enabled for the Impala Daemon UI."),
+  private=True,
+  default=None)
+
+
 
 def config_validator(user):
   # dbms is dependent on beeswax.conf (this file)

+ 5 - 0
apps/impala/src/impala/server.py

@@ -27,6 +27,7 @@ from beeswax.server.hive_server2_lib import HiveServerClient
 
 from ImpalaService import ImpalaHiveServer2Service
 from impala.impala_flags import get_webserver_certificate_file
+from impala.conf import DAEMON_API_USERNAME, DAEMON_API_PASSWORD
 
 
 LOG = logging.getLogger(__name__)
@@ -141,6 +142,10 @@ class ImpalaDaemonApi(object):
   def __init__(self, server_url):
     self._url = server_url
     self._client = HttpClient(self._url, logger=LOG)
+    # You can set username/password for Impala Web UI which overrides kerberos
+    if DAEMON_API_USERNAME.get() is not None and DAEMON_API_PASSWORD.get() is not None:
+      self._client.set_digest_auth(DAEMON_API_USERNAME.get(), DAEMON_API_PASSWORD.get())
+
     self._root = Resource(self._client)
     self._security_enabled = False
     self._thread_local = threading.local()

+ 7 - 0
desktop/conf.dist/hue.ini

@@ -1169,6 +1169,13 @@
   ## auth_username=hue
   ## auth_password=
 
+  # Username and password for Impala Daemon Web interface for getting Impala queries in JobBrowser
+  # Set when webserver_htpassword_user and webserver_htpassword_password are set for Impala
+  ## daemon_api_username=
+  ## daemon_api_password=
+  # Execute this script to produce the password to avoid entering in clear text
+  ## daemon_api_password_script=
+
   # A comma-separated list of white-listed Impala configuration properties that users are authorized to set.
   # config_whitelist=debug_action,explain_level,mem_limit,optimize_partition_key_scans,query_timeout_s,request_pool
 

+ 7 - 0
desktop/conf/pseudo-distributed.ini.tmpl

@@ -1171,6 +1171,13 @@
   ## auth_username=hue
   ## auth_password=
 
+  # Username and password for Impala Daemon Web interface for getting Impala queries in JobBrowser
+  # Set when webserver_htpassword_user and webserver_htpassword_password are set for Impala
+  ## daemon_api_username=
+  ## daemon_api_password=
+  # Execute this script to produce the password to avoid entering in clear text
+  ## daemon_api_password_script=
+
   # A comma-separated list of white-listed Impala configuration properties that users are authorized to set.
   ## config_whitelist=debug_action,explain_level,mem_limit,optimize_partition_key_scans,query_timeout_s,request_pool
 

+ 5 - 1
desktop/core/src/desktop/lib/rest/http_client.py

@@ -27,7 +27,7 @@ from django.utils.http import urlencode
 from desktop import conf
 
 from requests import exceptions
-from requests.auth import HTTPBasicAuth
+from requests.auth import HTTPBasicAuth, HTTPDigestAuth
 from requests_kerberos import HTTPKerberosAuth, REQUIRED, OPTIONAL, DISABLED
 from urllib3.contrib import pyopenssl
 
@@ -129,6 +129,10 @@ class HttpClient(object):
     self._session.auth = HTTPBasicAuth(username, password)
     return self
 
+  def set_digest_auth(self, username, password):
+    self._session.auth = HTTPDigestAuth(username, password)
+    return self
+
   def set_headers(self, headers):
     """
     Add headers to the request