[SENTRY-1757] Avoid using local hive meta store with wrong configuration

• Type: Sub-task
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 2.0.0
• Fix Version/s: 2.0.0
• Component/s: Sentry
• Labels: security
• Assignee: Na Li
• Reporter: Na Li
• Created: 09/May/17 19:37
• Updated: 25/Oct/17 18:55
• Resolved: 17/May/17 22:41

Description

When HMSFollower.getMetaStoreClient() checks if it should create HiveMetaStoreClient, it uses the input configuration from SentryService.

In real cluster deployment, the configuration does not contain value for "hive.metastore.uris", and therefore, HMSFollower never connects to the real meta store.

In integration test, the configuration contains value for "hive.metastore.uris". Therefore integration tests pass.

We need to check Hive configuration to avoid connecting to local meta store. And remove the value for "hive.metastore.uris" in integration test, so its behavior is the same as real cluster deployment.

TestHDFSIntegrationBase.startSentry() `properties.put("hive.metastore.uris", "thrift://localhost:" + hmsPort);` is introduced in SENTRY-1429, SENTRY-1454, and SENTRY-1456

Issue Links

• blocks: SENTRY-1705 Do not start HMSFollower if Hive isn't configured
• is broken by: SENTRY-1649 Initialize HMSFollower when sentry server actually starts
• is duplicated by: SENTRY-1723 HDFS e2e tests should wait for HMSFollower to start
• is duplicated by: SENTRY-1747 HMSFollower shouldn't create local hive during tests
• links to: Review Link for this case