[HIVE-15177] Authentication with hive fails when kerberos auth type is set to fromSubject and principal contains _HOST

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 4.0.0-alpha-1
• Component/s: Authentication
• Assignee: Oliver Draese
• Reporter: Subrahmanya
• Created: 10/Nov/16 15:07
• Updated: 17/Nov/22 08:55
• Resolved: 27/Jun/19 23:21

Description

Authentication with hive fails when kerberos auth type is set to fromSubject and principal contains _HOST.

When auth type is set to fromSubject, _HOST in principal is not resolved to the actual host name even though the correct host name is available. This leads to connection failure. If auth type is not set to fromSubject host resolution is done correctly.

The problem is in getKerberosTransport method of org.apache.hive.service.auth.KerberosSaslHelper class. When assumeSubject is true host name in the principal is not resolved. When it is false, host name is passed on to HadoopThriftAuthBridge, which takes care of resolving the parameter.