[HIVE-12981] ThriftCLIService uses incompatible getShortName() implementation

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 1.2.1, 2.0.0
• Fix Version/s: 1.2.2, 1.3.0, 2.1.0
• Component/s: Authentication, Authorization, CLI, Security
• Labels: kerberos
• Target Version/s: 1.2.2, 2.0.0, 2.1.0
• Flags: Patch
• Assignee: Bolke de Bruin
• Reporter: Bolke de Bruin
• Created: 02/Feb/16 12:01
• Updated: 10/Nov/16 01:12
• Resolved: 18/Feb/16 03:44

Description

ThriftCLIService has a local implementation getShortName() that assumes a short name is always the part before "@" and "/". This is not always the case as Kerberos Rules (from Hadoop's KerberosName) might actually transform a name to something else.

Considering a pending change to getShortName() (#HADOOP-12751) and the normal use of KerberosName in other parts of Hive it only seems logical to use the standard implementation.

Issue Links

• breaks: HIVE-13590 Kerberized HS2 with LDAP auth enabled fails in multi-domain LDAP case
• is related to: HIVE-15174 Respect auth_to_local rules from hdfs configs (core-site.xml) for LDAP authentication too
• relates to: HADOOP-12751 While using kerberos Hadoop incorrectly assumes names with '@' to be non-simple