[
https://issues.apache.org/jira/browse/HIVE-6486?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13925894#comment-13925894
]
Shivaraju Gowda commented on HIVE-6486:
---------------------------------------
Lefty Leverenz : OK sounds good.
Thejas M Nair: While my main intention to add this improvement was for
middle-ware server, I think it can be helpful even for regular Kerberos use
case, the advantage being no dependency on hadoop-core*.jar and more
flexibility on Kerberos login. The disadvantage being to know the details of
how to login to Kerberos programmatically(an example of how to do it will ease
this though).
> Support secure Subject.doAs() in HiveServer2 JDBC client.
> ---------------------------------------------------------
>
> Key: HIVE-6486
> URL: https://issues.apache.org/jira/browse/HIVE-6486
> Project: Hive
> Issue Type: Improvement
> Components: Authentication, HiveServer2, JDBC
> Affects Versions: 0.11.0, 0.12.0
> Reporter: Shivaraju Gowda
> Assignee: Shivaraju Gowda
> Fix For: 0.13.0
>
> Attachments: HIVE-6486.1.patch, HIVE-6486.2.patch, HIVE-6486.3.patch,
> Hive_011_Support-Subject_doAS.patch, TestHive_SujectDoAs.java
>
>
> HIVE-5155 addresses the problem of kerberos authentication in multi-user
> middleware server using proxy user. In this mode the principal used by the
> middle ware server has privileges to impersonate selected users in
> Hive/Hadoop.
> This enhancement is to support Subject.doAs() authentication in Hive JDBC
> layer so that the end users Kerberos Subject is passed through in the middle
> ware server. With this improvement there won't be any additional setup in the
> server to grant proxy privileges to some users and there won't be need to
> specify a proxy user in the JDBC client. This version should also be more
> secure since it won't require principals with the privileges to impersonate
> other users in Hive/Hadoop setup.
>
--
This message was sent by Atlassian JIRA
(v6.2#6252)
