[HIVE-3719] Improve HiveServer to support username/password authentication

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 0.9.0
• Component/s: Authentication, JDBC
• Labels: security
• Assignee: Yu Gao
• Reporter: Yu Gao
• Created: 17/Nov/12 02:55
• Updated: 17/Sep/15 00:30

Description

The current HiveServer implementation (call it HiveServer version 1 to distinguish it from HIveServer2 that is under development currently) does not have any authentication mechanism against connecting clients, which means anyone can access it, e.g. through Hive JDBC driver, without any security control. The user and password property are simply ignored by Hive JDBC driver and never get to HiveServer1.

It would be good to introduce authentication infrastructure to HiveServer 1, and improve JDBC driver implementation as well to support this, so that together with the existing authorization infrastructure, for applications that want to access HiveServer1 via JDBC driver, connections and operations are under security control.

Although there's HiveServer2 that has been under implementation for a while, this improvement for HiveServer1 is very necessary to fill the big security hole, and would benefit applications a lot that are using HiveServer1.

Issue Links

• requires: HADOOP-9083 Port HADOOP-9020 Add a SASL PLAIN server to branch 1