[HIVE-3807] Hive authorization should use short username when Kerberos authentication

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.9.0, 0.10.0
• Fix Version/s: 0.12.0
• Component/s: Authorization
• Assignee: Kai Zheng
• Reporter: Kai Zheng
• Created: 15/Dec/12 15:13
• Updated: 19/Feb/14 13:56
• Resolved: 02/Oct/13 15:33

Description

Currently when authentication method is Kerberos,Hive authorization uses user full name as privilege principal, for example, it uses [e-mail] instead of john.

It should use the short name instead. The benefits:
1. Be consistent. Hadoop, HBase and etc they all use short name in related ACLs or authorizations. For Hive authorization works well with them, this should be.
2. Be convenient. It's very inconvenient to use the lengthy Kerberos principal name when grant or revoke privileges via Hive CLI.

Issue Links

• is duplicated by: HIVE-4413 Parse Exception : character '@' not supported while granting privileges to user in a Secure Cluster through hive client.