[HIVE-6738] HiveServer2 secure Thrift/HTTP needs to accept doAs parameter from proxying intermediary

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.13.0
• Fix Version/s: 0.13.0
• Component/s: HiveServer2
• Hadoop Flags: Reviewed
• Assignee: Dilli Arumugam
• Reporter: Dilli Arumugam
• Created: 25/Mar/14 00:25
• Updated: 06/Apr/14 07:35
• Resolved: 05/Apr/14 23:29

Description

See already implemented JIra
https://issues.apache.org/jira/browse/HIVE-5155
Support secure proxy user access to HiveServer2

That fix expects the hive.server2.proxy.user parameter to come in Thrift body.

When an intermediary gateway like Apache Knox is authenticating the end client and then proxying the request to HiveServer2, it is not practical for the intermediary like Apache Knox to modify thrift content.

Intermediary like Apache Knox should be able to assert doAs in a query parameter. This paradigm is already established by other Hadoop ecosystem components like WebHDFS, WebHCat, Oozie and HBase and Hive needs to be aligned with them.

The doAs asserted in query parameter should override if doAs specified in Thrift body.

Issue Links

• blocks: HIVE-6837 HiveServer2 thrift/http mode & binary mode proxy user check fails reporting IP null for client
• is related to: HIVE-6625 HiveServer2 running in http mode should support trusted proxy access
• is related to: HIVE-5155 Support secure proxy user access to HiveServer2
• is related to: HIVE-6697 HiveServer2 secure thrift/http authentication needs to support SPNego
• links to: Review Board