[DRILL-2363] Support user impersonation in Drill

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.10.0
• Component/s: Execution - Flow, Metadata
• Labels: security
• Assignee: Unassigned
• Reporter: Venki Korukanti
• Created: 03/Mar/15 21:40
• Updated: 27/Jul/17 23:34
• Resolved: 19/Jun/17 00:33

Description

Currently Drill has no impersonation. All queries are run as the user who is running the Drillbit process and not as the user who issued the query from JDBC/ODBC. This restricts the controlling of who can query tables/views and who can create new tables/views.

This is a umbrella JIRA to track impersonation feature in Drill.

Issue Links

• incorporates: DRILL-2514 Add support for impersonation in FileSystem storage plugin
• is depended upon by: DRILL-1724 Can't use ~ to specify home directory in table path
• is duplicated by: DRILL-1413 Use user identity from Java or C++ DrillClient for storage plugin access
• is related to: DRILL-2442 C++ Client Support - Add impersonation (and other user properties) support

Sub-Tasks

• FileSystemPlugin refactoring: avoid sharing DrillFileSystem across schemas: Resolved
• Add support for impersonation in FileSystem storage plugin: Resolved
• Update UserServer <==> UserClient RPC to handle handshake response better: Resolved
• Add user authenticator interface and PAM based implementation: Resolved
• Package native PAM library for Linux in Drill tar.gz: Open
• Add support for context UDFs: user (and its synonyms session_user, system_user) and current_schema: Resolved
• Add support for impersonation in Hive storage plugin: Resolved