[HIVE-1696] Add delegation token support to metastore

• Type: Sub-task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 0.7.0
• Component/s: Authentication, Metastore, Security, Server Infrastructure
• Hadoop Flags: Reviewed
• Assignee: Devaraj Das
• Reporter: Todd Lipcon
• Created: 06/Oct/10 18:10
• Updated: 05/Jul/18 15:46
• Resolved: 19/Jan/11 17:28

Description

As discussed in HIVE-842, kerberos authentication is only sufficient for authentication of a hive user client to the metastore. There are other cases where thrift calls need to be authenticated when the caller is running in an environment without kerberos credentials. For example, an MR task running as part of a hive job may want to report statistics to the metastore, or a job may be running within the context of Oozie or Hive Server.

This JIRA is to implement support of delegation tokens for the metastore. The concept of a delegation token is borrowed from the Hadoop security design - the quick summary is that a kerberos-authenticated client may retrieve a binary token from the server. This token can then be passed to other clients which can use it to achieve authentication as the original user in lieu of a kerberos ticket.

Issue Links

• is blocked by: HIVE-842 Authentication Infrastructure for Hive
• is depended upon by: HIVE-2467 HA Support for Metastore Server
• relates to: HIVE-3255 Add DBTokenStore to store Delegation Tokens in DB
• relates to: HIVE-13363 Add hive.metastore.token.signature property to HiveConf