Uploaded image for project: 'Hive'
  1. Hive
  2. HIVE-17187

WebHCat SPNEGO support is incompleted

    XMLWordPrintableJSON

    Details

    • Type: Bug
    • Status: Open
    • Priority: Major
    • Resolution: Unresolved
    • Affects Version/s: 1.2.1
    • Fix Version/s: None
    • Component/s: WebHCat
    • Labels:
      None

      Description

      Some online document describes how to setup WebHCat with SPNEGO support. However, there could be multiple services use SPNEGO on the same host. For example, HBase REST API can also setup to use HTTP principal for SPNEGO support. When HTTP principal is shared among other services, Hadoop proxy user settings can not identify the origin of doAs call with HTTP principal, is invoked by HBase REST API or WebHCat. Ideally, WebHCat should keep track of its own service principal independent of SPNEGO principal to ensure that SPNEGO principal is only given authentication access. SPNEGO principal should not be used in proxy user setting to grant authorization access.

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                Unassigned
                Reporter:
                eyang Eric Yang
              • Votes:
                0 Vote for this issue
                Watchers:
                2 Start watching this issue

                Dates

                • Created:
                  Updated: