CalvinKirs opened a new pull request, #47192:
URL: https://github.com/apache/doris/pull/47192
### What problem does this PR solve?
Using JNI to directly read Paimon tables can lead to query failures when the
Paimon storage is on HDFS with Kerberos authentication enabled.
#### Reproduction Steps:
- Create a Paimon catalog stored on an HDFS cluster with Kerberos
authentication enabled.
- Execute the command: SET force_jni_scanner=true;.
- To ensure a clean environment, restart the BE (Backend) service.
- Perform any query on a table within the catalog.
```
2025-01-18 09:25:06 WARN Thread-13
org.apache.doris.paimon.PaimonJniScanner.open(PaimonJniScanner.java:126) -
Failed to open paimon_scanner: java.io.UncheckedIOException:
org.apache.hadoop.security.AccessControlException:
org.apache.hadoop.security.AccessControlException: SIMPLE authentication is not
enabled. Available:[TOKEN, KERBEROS]
com.google.common.util.concurrent.UncheckedExecutionException:
java.io.UncheckedIOException:
org.apache.hadoop.security.AccessControlException:
org.apache.hadoop.security.AccessControlException: SIMPLE authentication is not
enabled. Available:[TOKEN, KERBEROS]
at
com.google.common.cache.LocalCache$Segment.get(LocalCache.java:2085)
at com.google.common.cache.LocalCache.get(LocalCache.java:4017)
at com.google.common.cache.LocalCache.getOrLoad(LocalCache.java:4040)
at
com.google.common.cache.LocalCache$LocalLoadingCache.get(LocalCache.java:4989)
at
org.apache.doris.paimon.PaimonTableCache.getTable(PaimonTableCache.java:84)
at
org.apache.doris.paimon.PaimonJniScanner.initTable(PaimonJniScanner.java:237)
at
org.apache.doris.paimon.PaimonJniScanner.open(PaimonJniScanner.java:122)
Caused by: java.io.UncheckedIOException:
org.apache.hadoop.security.AccessControlException:
org.apache.hadoop.security.AccessControlException: SIMPLE authentication is not
enabled. Available:[TOKEN, KERBEROS]
at
org.apache.paimon.hive.HiveCatalog.createHiveCatalog(HiveCatalog.java:708)
at
org.apache.paimon.hive.HiveCatalogFactory.create(HiveCatalogFactory.java:48)
at
org.apache.paimon.catalog.CatalogFactory.createCatalog(CatalogFactory.java:76)
at
org.apache.paimon.catalog.CatalogFactory.createCatalog(CatalogFactory.java:66)
at
org.apache.doris.paimon.PaimonTableCache.createCatalog(PaimonTableCache.java:75)
at
org.apache.doris.paimon.PaimonTableCache.loadTable(PaimonTableCache.java:58)
at
org.apache.doris.paimon.PaimonTableCache.access$000(PaimonTableCache.java:38)
at
org.apache.doris.paimon.PaimonTableCache$1.load(PaimonTableCache.java:51)
at
org.apache.doris.paimon.PaimonTableCache$1.load(PaimonTableCache.java:48)
at
com.google.common.cache.LocalCache$LoadingValueReference.loadFuture(LocalCache.java:3574)
at
com.google.common.cache.LocalCache$Segment.loadSync(LocalCache.java:2316)
at
com.google.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2189)
at
com.google.common.cache.LocalCache$Segment.get(LocalCache.java:2079)
... 6 more
```
#### changes
This PR addresses an issue where queries fail when attempting to directly
read Paimon tables using JNI, specifically in environments where HDFS is used
as the storage backend and Kerberos authentication is enabled. The failure is
caused by the lack of proper Kerberos authentication handling in the JNI
implementation.
### Release note
None
### Check List (For Author)
- Test <!-- At least one of them must be included. -->
- [ ] Regression test
- [ ] Unit Test
- [ ] Manual test (add detailed scripts or steps below)
After updating the code, repeat the reproduction steps outlined above.
- [ ] No need to test or manual test. Explain why:
- [ ] This is a refactor/code format and no logic has been changed.
- [ ] Previous test can cover this change.
- [ ] No code files have been changed.
- [ ] Other reason <!-- Add your reason? -->
- Behavior changed:
- [ ] No.
- [ ] Yes. <!-- Explain the behavior change -->
- Does this need documentation?
- [ ] No.
- [ ] Yes. <!-- Add document PR link here. eg:
https://github.com/apache/doris-website/pull/1214 -->
### Check List (For Reviewer who merge this PR)
- [ ] Confirm the release note
- [ ] Confirm test cases
- [ ] Confirm document
- [ ] Add branch pick label <!-- Add branch pick label that this PR should
merge into -->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscr...@doris.apache.org
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscr...@doris.apache.org
For additional commands, e-mail: commits-h...@doris.apache.org
