[HIVE-4601] WebHCat needs to support proxy users

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.11.0
• Fix Version/s: 0.12.0
• Component/s: HCatalog
• Labels: proxy templeton
• Assignee: Eugene Koifman Assign to me
• Reporter: Dilli Arumugam
• Created: 23/May/13 23:29
• Updated: 15/Oct/13 23:29
• Resolved: 30/Aug/13 07:07

Description

We have a use case where a Gateway would provide unified and controlled access to secure hadoop cluster.
The Gateway itself would authenticate to secure WebHDFS, Oozie and Templeton with SPNego.
The Gateway would authenticate the end user with http basic and would assert the end user identity as douser argument in the calls to downstream WebHDFS, Oozie and Templeton.
This works fine with WebHDFS and Oozie. But, does not work for Templeton as Templeton does not support proxy users.
Hence, request to add this improvement to Templeton.

Issue Links

• depends upon: HIVE-5248 WebHCat Proxy User Support (HIVE-4601) requires documentation
• is blocked by: HIVE-5051 StorageBasedAuthorizationProvider masks lower level exception with IllegalStateException
• is related to: HIVE-5001 [WebHCat] JobState is read/written with different user credentials