[HBASE-4475] When running an embedded ThriftServer, use User.runAs() to allow it to run as a separate principal from the embedding region server

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Not A Problem
• Component/s: security, Thrift
• Assignee: Unassigned
• Reporter: Gary Helmling
• Created: 23/Sep/11 23:37
• Updated: 12/Jun/22 19:36
• Resolved: 24/Dec/14 19:51

Description

As discussed over in HBASE-4460, the current approach to ThriftServer authentication (provided in HBASE-4099) will not work in an embedded context, since the region server will already does a login for the process.

We could make the embedded thrift server still run as a separate user, though, by doing something like the following:

• add a User.loginAndReturnUser() variant that delegates to UserGroupInformation.loginUserFromKeytabAndReturnUGI(), then returns a wrapping User instance
• call this method on startup for the embedded thrift server to get the thrift user instance
• use User.runAs() to execute the body of HRegionThriftServer.run() as the logged in thrift user

Issue Links

• relates to: HBASE-4099 Authentication for ThriftServer clients
• relates to: HBASE-4460 Support running an embedded ThriftServer within a RegionServer