[HIVE-25349] Skip password authentication when a trusted header is present in the Http request

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 4.0.0-alpha-1
• Component/s: Hive, HiveServer2
• Labels: pull-request-available security-review-needed
• Assignee: Sai Hemanth Gantasala
• Reporter: Sai Hemanth Gantasala
• Created: 19/Jul/21 18:24
• Updated: 17/Nov/22 08:48
• Resolved: 18/Nov/21 15:23

Description

Whenever a trusted header is present in the HTTP servlet request, skip the password based authentication, since the user is pre-authorized and extract the user name from Authorization header.

Issue Links

• links to: GitHub Pull Request #2496