[IMPALA-12318] Use spnego dedicated keytab

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: Impala 4.4.0
• Component/s: Security
• Epic Color: ghx-label-13
• Assignee: halim kim
• Reporter: halim kim
• Created: 26/Jul/23 05:33
• Updated: 26/Sep/23 15:55
• Resolved: 26/Sep/23 15:55

Description

Kerberos is one of the authentication methods that impala provides.
Kerberized impala uses its keytab that has impala principal for authentication.

kerberos authentication can be applied by setting '-principal' and '-keytab_file' flags.
Further more, It is possible to kerberize impala web console by having --webserver_require_spnego as true.

The problem is impala uses just one keytab file. Therefore, a keytab must have both impala and HTTP spnego principal If you want to kerberize web console too.

As far as i know, Other service like hadoop, hive and etc provides a option to use http spnego dedicated keytab file and there are cases that using seperate http spnego keytab and service keytab. So providing a way to use another keytab file for http spnego will make users handle kerberos keytab file more easily.

Issue Links

• depends upon: KUDU-3496 Support for SPNEGO dedicated keytab
• links to: Code Review