[HIVE-4911] Enable QOP configuration for Hive Server 2 thrift transport

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 0.12.0

Release Note

This patch adds feature to enable enable integrity protection and confidentiality protection ( beyond just the default of authentication), for communication between hive jdbc driver and hive server2 . You can use SASL (http://en.wikipedia.org/wiki/Simple_Authentication_and_Security_Layer) QOP property (http://docs.oracle.com/javase/7/docs/api/javax/security/sasl/Sasl.html#QOP) configure this.

- This is only when kerberos is used for the HS2 client (jdbc/odbc application) authentication with HS2.
- hive.server2.thrift.sasl.qop in hive site.xml has to be set to one of valid QOP values ('auth', 'auth-int' or 'auth-conf')
- specify sasl.qop in hive connection string sessionconf part of your jdbc hive connection string. eg jdbc:hive://hostname/dbname;sasl.qop=auth-int

This also adds SASL QOP protection for metastore client server communication. You can enable it using hadoop configuration paramter hadoop.rpc.protection.

• Assignee: Arup Malakar
• Reporter: Arup Malakar
• Created: 22/Jul/13 20:03
• Updated: 22/Mar/14 20:05
• Resolved: 08/Aug/13 20:05

Description

The QoP for hive server 2 should be configurable to enable encryption. A new configuration should be exposed "hive.server2.thrift.sasl.qop". This would give greater control configuring hive server 2 service.

Issue Links

• is duplicated by: HIVE-4225 HiveServer2 does not support SASL QOP
• is related to: HIVE-5120 document what hive.server2.thrift.sasl.qop values mean in hive-default.xml.template
• supercedes: HIVE-4225 HiveServer2 does not support SASL QOP