[IMPALA-6451] Creating a Kudu table with CTAS fails with AuthorizationException: User 'username' does not have privileges to access: server1

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: Impala 2.8.0, Impala 2.9.0, Impala 2.10.0, Impala 2.11.0
• Fix Version/s: Impala 3.0, Impala 2.12.0
• Component/s: Frontend, Security
• Labels: security usability
• Epic Color: ghx-label-2
• Assignee: Fredy Wijaya
• Reporter: Tomas Farkas
• Created: 30/Jan/18 09:00
• Updated: 13/Apr/18 23:00
• Resolved: 13/Apr/18 20:56

Description

In a Sentry enabled Kerberized environment user cannot create a Kudu table from a SELECT statement if it has a function, even though it has an ALL privilege on work database.

 

create table work.tfsource ( i bigint , s string );
insert into work.tfsource select 1, 'Test row';

create table work.tfdest primary key ( i ) partition by hash ( i ) partitions 5 stored as kudu as 
select `i`, `s`, current_timestamp() as ins_date from `work`.`tfsource` limit 5;

AuthorizationException: User '****' does not have privileges to access: server1

create table work.tfsource ( i bigint , s string );
insert into work.tfsource select 1, 'Test row';

create table work.tfdest primary key ( i ) partition by hash ( i ) partitions 5 stored as kudu as 
select `i`, `s`, 0 as ins_date from `work`.`tfsource` limit 5;

Inserted 1 row(s)

 

It seems that if in the select statement is any function (tested now(), day("2018-02-16"0) then it requires server level ALL priviliges.

Kudu version:

kudu 1.5.0-cdh5.13.1 revision 9044f1f377a6f2044d800600e5c2dc5e989c4dd4 build type RELEASE built by jenkins at 09 Nov 2017 08:50:42 PST on impala-ec2-pkg-centos-7-0c27.vpc.cloudera.com build id 2017-11-09_08-09-26