[CALCITE-5947] Use existing ticket cache for kerberos login

• Type: New Feature
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: avatica-1.23.0
• Component/s: avatica
• Assignee: Unassigned
• Reporter: Istvan Toth
• Created: 21/Aug/23 12:34
• Updated: 21/Aug/23 12:34

Description

Avatica currently requires that a kerberos principal and keytab is supplied in the JDBC URL for for connecting to a kerberized PQS.

This is often sub-optimal solution.

It would be much more user-friendly, if Avatica could simply use an existing ticket from the ticket cache.

The algorithm could be something like this:

• if principal and keytab is supplied in the URL:
  current behaviour
• If only principal is supplied:
  try to load the ticket for the prinicpal from cache
• If neither is supplied:
  Use first/default principal in the cache

Most of the logic could be directly lifted from Phoenix Query Server:

https://github.com/apache/phoenix-queryserver/blob/master/phoenix-queryserver-client/src/main/java/org/apache/phoenix/queryserver/client/KerberosLoginFromTicketCache.java

Issue Links

• is related to: CALCITE-1214 Support url-based kerberos login