[HAWQ-1485] Use user/password instead of credentials cache in Ranger lookup for HAWQ with Kerberos enabled.

• Type: Sub-task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.3.0.0-incubating
• Component/s: Security
• Assignee: Hongxu Ma
• Reporter: Hongxu Ma
• Created: 13/Jun/17 04:06
• Updated: 16/Jun/17 02:10
• Resolved: 16/Jun/17 02:10

Description

When used credentials cache:
Try error password in Ranger UI doesn't destroy the existed kerberos credentials (created by last success kinit command)
It's a strange behavior to user.

So we should use user/password for kerberos authentication.
Core logic:

        Properties props = new Properties();
        if (connectionProperties.containsKey(AUTHENTICATION) && connectionProperties.get(AUTHENTICATION).equals(KERBEROS)) {
            //kerberos mode
            props.setProperty("kerberosServerName", connectionProperties.get("principal"));
            props.setProperty("jaasApplicationName", "pgjdbc");
        }

        String url = String.format("jdbc:postgresql://%s:%s/%s", connectionProperties.get("hostname"), connectionProperties.get("port"), db);
        props.setProperty("user", connectionProperties.get("username"));
        props.setProperty("password", connectionProperties.get("password"));

        return DriverManager.getConnection(url, props);

Issue Links

• links to: GitHub Pull Request #1253
• links to: GitHub Pull Request #1256