[DRILL-6283] WebServer stores SPNEGO client principal without taking any conversion rule

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.13.0
• Fix Version/s: 1.14.0
• Component/s: Web Server
• Labels: ready-to-commit
• Assignee: Sorabh Hamirwasia
• Reporter: Sorabh Hamirwasia
• Reviewer: Arina Ielchiieva
• Created: 21/Mar/18 20:21
• Updated: 26/Mar/18 12:00
• Resolved: 26/Mar/18 11:52

Description

Drill's WebServer uses the exact client principal ([e-mail]) as the stored username, it doesn't provide any configuration to specify rules which can be used to extract desired username from client's principal.

For example: default rule provided by HadoopKerberosName extracts only the primary part (user1) in client principal. 

Also while checking if authenticated client principal has admin privileges or not it uses realm (e.g. QA.LAB) information to verify against configured admin user/group list. To make it consistent with JDBC/ODBC kerberos path, it should use the shortName in client principal to determine admin privileges.

Basically server side should store the shortName from client principal extracted based on configured rule and use that to determine the admin privileges too.

Issue Links

• links to: GitHub Pull Request #1180