wangzhigang1999 commented on code in PR #7431:
URL: https://github.com/apache/kyuubi/pull/7431#discussion_r3317492415
##########
externals/kyuubi-data-agent-engine/src/main/java/org/apache/kyuubi/engine/dataagent/provider/chatcompletion/ChatCompletionProvider.java:
##########
@@ -118,15 +118,29 @@ private static DataSource attachJdbcDataSource(
if (jdbcUrl == null) {
return null;
}
- LOG.info("Data Agent JDBC URL configured ({})",
jdbcUrl.replaceAll("//.*@", "//<redacted>@"));
-
- String sessionUser =
- ConfUtils.optionalString(conf,
KyuubiReservedKeys.KYUUBI_SESSION_USER_KEY());
-
- DataSource ds = DataSourceFactory.create(jdbcUrl, sessionUser);
+ JdbcDialect dialect = JdbcDialect.fromUrl(jdbcUrl);
+ if (dialect == null) {
+ throw new IllegalArgumentException(
+ "Invalid " + KyuubiConf.ENGINE_DATA_AGENT_JDBC_URL().key());
+ }
+ LOG.info("Data Agent JDBC datasource configured ({})",
dialect.datasourceName());
+
+ // The kyuubi session user is only meaningful when we connect back to
Kyuubi/HiveServer2,
+ // where it drives proxy-user impersonation for the downstream engine. For
external JDBC
+ // backends (mysql, postgresql, trino, ...) it would shadow URL-supplied
credentials and
+ // cause auth failures (e.g. MySQL Connector/J overriding ?user=root with
anonymous), so
+ // leave the username unset and let the driver read it from the URL.
+ String subprotocol = JdbcDialect.extractSubprotocol(jdbcUrl);
Review Comment:
The change here is minimal: for Kyuubi/Hive2 backends, the session user is
only injected when the URL does not carry an explicit `;user=` session
variable, so `jdbc:kyuubi://host/db;user=alice;password=xxx` now flows through
to the driver as-is.
The cleaner answer is explicit `jdbc.username` / `jdbc.password` config keys
plus matching UI inputs (which would also keep passwords out of logs / JMX /
browser history). I'll open a follow-up issue for that — out of scope here.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
