[
https://issues.apache.org/jira/browse/HIVE-29778?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
owenmonn updated HIVE-29778:
----------------------------
Description:
ThriftCLIService#getSessionHandle logs req.getUsername() instead of the
resolved userName parameter that is actually passed to CLIService#openSession /
#openSessionWithImpersonation:
{code:java}
LOG.info("Creating Hive session handle for user [{}] from IP {}",
req.getUsername(), ipAddress);{code}
The Hive JDBC driver only populates TOpenSessionReq.username when auth=noSasl.
Under Kerberos, LDAP/SASL PLAIN and HTTP transport the identity arrives via the
SASL authorization ID or a thread-local, so the line reads "Creating Hive
session handle for user [null] from IP <ip>".
Fix: use the userName parameter, which is already in scope.
was:
ThriftCLIService#getSessionHandle logs req.getUsername() instead of the
resolved userName parameter that is actually passed to CLIService#openSession /
#openSessionWithImpersonation:
{code:java}
LOG.info("Creating Hive session handle for user [{}] from IP {}",
req.getUsername(), ipAddress);{code}
The Hive JDBC driver only populates TOpenSessionReq.username when auth=noSasl.
Under Kerberos, LDAP/SASL PLAIN and HTTP transport the identity arrives via the
SASL authorization ID or a thread-local, so the line reads "Creating Hive
session handle for user [null] from IP <ip>".
Fix: use the userName parameter, which is already in scope.
> HiveServer2 logs the raw request username instead of the effective user when
> creating a session handle
> ------------------------------------------------------------------------------------------------------
>
> Key: HIVE-29778
> URL: https://issues.apache.org/jira/browse/HIVE-29778
> Project: Hive
> Issue Type: Bug
> Components: HiveServer2
> Affects Versions: 4.2.0
> Reporter: owenmonn
> Assignee: owenmonn
> Priority: Major
>
> ThriftCLIService#getSessionHandle logs req.getUsername() instead of the
> resolved userName parameter that is actually passed to CLIService#openSession
> / #openSessionWithImpersonation:
> {code:java}
> LOG.info("Creating Hive session handle for user [{}] from IP {}",
> req.getUsername(), ipAddress);{code}
> The Hive JDBC driver only populates TOpenSessionReq.username when
> auth=noSasl. Under Kerberos, LDAP/SASL PLAIN and HTTP transport the identity
> arrives via the SASL authorization ID or a thread-local, so the line reads
> "Creating Hive session handle for user [null] from IP <ip>".
>
> Fix: use the userName parameter, which is already in scope.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
