[HIVE-5353] job submission that requires access to metastore should not require additional jars to be shipped to target node

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Won't Fix
• Affects Version/s: 0.12.0
• Fix Version/s: 0.13.0
• Component/s: WebHCat
• Assignee: Eugene Koifman
• Reporter: Eugene Koifman
• Created: 25/Sep/13 00:07
• Updated: 22/Sep/14 23:36
• Resolved: 15/Oct/13 23:49

Description

HIVE-5133 adds support for secure metastore access using delegation tokens. This is needed for example when a pig job is submitted via WebHcat, and the Pig script uses HCat, which has to access metadata and thus the metastore.

When the job is complete the delegation token should be cancelled. HIVE-5133 implements it as an OutputCommitter but this requires relevant jars to be shipped to the node where TempletonControllerJob is run. This makes configuration more difficult.

Since Hive (and thus all the necessary jars for token cancellation) must be installed on the same node where WebHCat is running, the token can be cancelled from WebHCat when it receives a callback from Hadoop that the job is finished. Thus no additional jars need to be shipped anywhere.

Issue Links

• is related to: HIVE-5133 webhcat jobs that need to access metastore fails in secure mode