[LENS-1506] Kerberos authentication in lens

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.8
• Component/s: client, driver-hive, python-client, server
• Assignee: Ankit Kailaswar
• Reporter: Ankit Kailaswar
• Created: 13/Mar/18 09:21
• Updated: 05/Apr/18 13:00
• Resolved: 05/Apr/18 12:08

Description

Current Lens implementation is broken when we try to enable kerberos authentication in lens as mentioned at https://cwiki.apache.org/confluence/display/Hive/Setting+Up+HiveServer2 in following ways,
1. openSession REST API fails to create new session for user. Currently it supports only passwd types of authentication.

2. If the underlying hive driver is running with kerberos authentication then driver initialization flow to obtain hive transport for hive driver in lens errors out. Hive server accepts only sasl messages but lens continues using PLAINSASL.

3. If hadoop cluster has kerberos authentication enabled then all hdfs calls (persisting services, all hdfs path in conf etc) fail.
4. Lens as if now doesnt supports refreshing KDC token before it expires.

Changes required in lens to fully support kerberose authentication are as follows,

1. lens's hive driver must use SASL for all communication in to kerberozied hive. Current thrift client for hive doesn't support this functionality.
2. Lens must refresh KDC ticket before it expires.
3. All clients must be authenticated with kerberose authentication before session creation.
4. In kerberos mode all hive driver query should be executed with single cluster user as "lens".