[HIVE-20651] JdbcStorageHandler password should be encrypted

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.2.0, 4.0.0-alpha-1
• Component/s: StorageHandler
• Target Version/s: 3.2.0, 4.0.0
• Hadoop Flags: Reviewed
• Assignee: Daniel Dai
• Reporter: Daniel Dai
• Created: 28/Sep/18 07:11
• Updated: 17/Nov/22 08:54
• Resolved: 07/Oct/18 17:29

Description

Currently, external jdbc table with JdbcStorageHandler store password as "hive.sql.dbcp.password" table property in clear text. We should put it in a keystore file. Here is the proposed change:

….
STORED BY 'org.apache.hive.storage.jdbc.JdbcStorageHandler'
TBLPROPERTIES (
"hive.sql.dbcp.password.keystore" = "hdfs:///user/hive/credential/postgres.jceks",
"hive.sql.dbcp.password.key" = "mydb.password"
);

 
The jceks file is created with:

hadoop credential create mydb.password -provider hdfs:///user/hive/credential/postgres.jceks -v secretpassword

User can choose to put all db password in one jceks, or a separate jceks for each db.

Issue Links

• links to: RB