[HIVE-12188] DoAs does not work properly in non-kerberos secured HS2

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.3.0, 2.0.0
• Component/s: Security
• Assignee: Chaoyu Tang
• Reporter: Chaoyu Tang
• Created: 15/Oct/15 17:13
• Updated: 23/May/23 10:35
• Resolved: 18/Oct/15 23:46

Description

The case with following settings is valid but it seems still not work correctly in current HS2
==
hive.server2.authentication=NONE (or LDAP)
hive.server2.enable.doAs= true
hive.metastore.sasl.enabled=true (with HMS Kerberos enabled)
==
Currently HS2 is able to fetch the delegation token to a kerberos secured HMS only when itself is also kerberos secured.

Issue Links

• is related to: SPARK-43743 Port HIVE-12188: DoAs does not work properly in non-kerberos secured HS2
• is related to: HIVE-6245 HS2 creates DBs/Tables with wrong ownership when HMS setugi is true