[IMPALA-11298] Compare only the short username when checking session user against connection user

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Target Version: Impala 4.5.0
• Epic Color: ghx-label-12
• Assignee: Abhishek Rawat
• Reporter: Vincent Tran
• Created: 17/May/22 18:42
• Updated: 16/Oct/24 04:39
• Resolved: 16/Oct/24 04:39

Description

When checking that the session user matches the user authenticated on the connection, the usernames compared include the client hostname and the realm

        if (!connection_username.empty()
            && session_->connected_user != connection_username) {
          return Status::Expected(TErrorCode::UNAUTHORIZED_SESSION_USER,
              connection_username, session_->connected_user);
        }

This can result in exceptions like so:

The user authorized on the connection 'hue/[e-mail]' does not match the session username 'hue/[e-mail]'

We should convert these to short name before comparing.