[IMPALA-7052] Impersonate the real user in reading/writing HDFS

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Duplicate
• Component/s: Backend, Security
• Epic Color: ghx-label-2
• Assignee: Unassigned
• Reporter: Quanlong Huang
• Created: 21/May/18 00:52
• Updated: 23/Dec/20 21:45
• Resolved: 23/Dec/20 21:45

Description

Currently, FileMetadata is loaded by catalogd using the process's username which is usually "impala". We judge the authorization using Sentry after the metadata is loaded. However, in the backend, when reading/writing HDFS, we still using the process's username but not the query's username (the real user).

In a Hadoop cluster without Sentry, it may only use ACLs for authorization. Our behavior prevents it to work correctly since the real username is not used in reading/writing HDFS.

We should provide a server level option for admins to decide whether to enable impersonation in Backend. If so, propagate the real username to RequestRange and impersonate the real user.

Issue Links

• duplicates: IMPALA-2177 Implement End-User Impersonation for Impala