[HIVE-15025] Secure-Socket-Layer (SSL) support for HMS

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.2.0
• Fix Version/s: 2.3.0
• Component/s: Metastore
• Labels: TODOC2.2

Release Note

The patch adds the following properties to hive configuration.
hive.metastore.use.SSL: to enable/disable SSL encryption for the communication between the client and HMS server.
The following properties are used when hive.metastore.use.SSL is set to true.
hive.metastore.keystore.path: the keystore file used by HMS server
hive.metastore.keystore.password: the keystore file password
hive.metastore.truststore.path: the truststore file used by HS2 server (acting as HMS client to connect to HMS server)
hive.metastore.truststore.password: the truststore file password

SSL encryption is only used to encrypt the communication to HMS when no kerberos authentication is enabled for HMS. When SSL is enabled for HMS, HS2 (one of the HMS clients) uses hive.metastore.use.SSL flag to enable SSL on the client side. Other HMS clients are required to support SSL in non-kerberos mode in order to communicate with HMS.

• Assignee: Aihua Xu
• Reporter: Aihua Xu
• Created: 20/Oct/16 16:01
• Updated: 24/Oct/23 03:02
• Resolved: 27/Oct/16 14:02

Description

HMS server should support SSL encryption. When the server is keberos enabled, the encryption can be enabled. But if keberos is not enabled, then there is no encryption between HS2 and HMS.

Similar to HS2, we should support encryption in both cases.

Issue Links

• is related to: HIVE-27817 Disable ssl hostname verification for 127.0.0.1
• links to: Code review

Sub-Tasks

• Add test to cover data encryption when HMS is configured to authenticate kerberos: Open