[HIVE-6799] HiveServer2 needs to map kerberos name to local name before proxy check

• Type: Improvement
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 0.13.1
• Fix Version/s: 0.14.0
• Component/s: HiveServer2
• Assignee: Dilli Arumugam
• Reporter: Dilli Arumugam
• Created: 31/Mar/14 23:28
• Updated: 13/Nov/14 19:42
• Resolved: 03/Oct/14 05:48

Description

HiveServer2 does not map kerberos name of authenticated principal to local name.

Due to this, I get error like the following in HiveServer log:
Failed to validate proxy privilage of knox/hdps.example.com for sam

I have KINITED as knox/[e-mail]

I do have the following in core-site.xml

<property>
<name>hadoop.proxyuser.knox.groups</name>
<value>users</value>
</property>
<property>
<name>hadoop.proxyuser.knox.hosts</name>
<value>*</value>
</property>

Issue Links

• blocks: HIVE-8324 Shim KerberosName (causes build failure on hadoop-1)
• links to: Review Board