[IMPALA-9430] Kerberos configs should be passed through to Kerberos libraries even if principal is not set

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: Impala 3.4.0
• Component/s: Backend
• Labels: kerberos security
• Epic Color: ghx-label-8
• Assignee: Tim Armstrong
• Reporter: Tim Armstrong
• Created: 26/Feb/20 18:12
• Updated: 17/Mar/20 15:27
• Resolved: 12/Mar/20 04:49

Description

InitKerberosEnv() configures native and JDK kerberos implementations based on command-line flags: https://github.com/apache/impala/blob/d1b42c836c3458a2ef3662c0b0b1fd8fbf8f2baf/be/src/rpc/authentication.cc#L866 . It only does this when --principal is set.

It's possible that Impala can be set up to use kerberos to communicate with some external services, e.g. HMS or Hive, even if --principal is not set, since those clients read in config XML files that are independent of the Impala flags. This isn't a recommended configuration and requires a fair bit of expertise to get right, but I think it's very surprising that the configs don't get passed through in the case. The documentation doesn't mention this behaviour.

The suggested change here is to apply the config changes independent of the value of --principal. It should be a noop if kerberos is not configured for any services.

Issue Links

• is related to: IMPALA-9456 Allow disabling kerberos for incoming internal and external connections even if --principal is set
• Wiki Page: Wiki Page Loading...