jerqi commented on code in PR #6778:
URL: https://github.com/apache/gravitino/pull/6778#discussion_r2022048078
##########
catalogs/catalog-hive/src/main/java/org/apache/gravitino/catalog/hive/HiveProxyPlugin.java:
##########
@@ -60,19 +60,22 @@ public Object doAs(
// The http authentication use one KDC server, the Hive catalog may
use another KDC server.
// The KerberosAuthenticator will remove realm of principal.
// And then we add the realm of Hive catalog to the user.
+ final String finalPrincipalName;
String proxyKerberosPrincipalName = principal.getName();
if (!proxyKerberosPrincipalName.contains("@")) {
- proxyKerberosPrincipalName =
+ finalPrincipalName =
String.format("%s@%s", proxyKerberosPrincipalName,
ops.getKerberosRealm());
+ } else {
+ finalPrincipalName = proxyKerberosPrincipalName;
}
- proxyUser =
UserGroupInformation.createProxyUser(proxyKerberosPrincipalName, realUser);
+ proxyUser = UserGroupInformation.createProxyUser(finalPrincipalName,
realUser);
String token =
ops.getClientPool()
.run(
client -> {
- return client.getDelegationToken(principal.getName(),
realUser.getUserName());
+ return client.getDelegationToken(finalPrincipalName,
realUser.getUserName());
Review Comment:
Maybe we change this `principal.getName()` to `proxyKerberosPrincipalName`
to solve this error. Can you test it?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
