[HIVE-11826] 'hadoop.proxyuser.hive.groups' configuration doesn't prevent unauthorized user to access metastore

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.0.0
• Fix Version/s: 1.3.0, 2.0.0
• Component/s: Metastore
• Hadoop Flags: Reviewed
• Assignee: Aihua Xu
• Reporter: Aihua Xu
• Created: 15/Sep/15 15:07
• Updated: 16/Feb/16 23:52
• Resolved: 21/Sep/15 16:46

Description

With 'hadoop.proxyuser.hive.groups' configured in core-site.xml to certain groups, currently if you run the job with a user not belonging to those groups, it won't fail to access metastore. With old version hive 0.13, actually it fails properly.

Seems HadoopThriftAuthBridge20S.java correctly call ProxyUsers.authorize() while HadoopThriftAuthBridge23 doesn't.

Issue Links

• breaks: HIVE-12688 HIVE-11826 makes hive unusable in properly secured cluster