pan3793 commented on code in PR #7431:
URL: https://github.com/apache/kyuubi/pull/7431#discussion_r3387089810
##########
externals/kyuubi-data-agent-engine/src/main/java/org/apache/kyuubi/engine/dataagent/provider/chatcompletion/ChatCompletionProvider.java:
##########
@@ -118,18 +118,46 @@ private static DataSource attachJdbcDataSource(
if (jdbcUrl == null) {
return null;
}
- LOG.info("Data Agent JDBC URL configured ({})",
jdbcUrl.replaceAll("//.*@", "//<redacted>@"));
-
- String sessionUser =
- ConfUtils.optionalString(conf,
KyuubiReservedKeys.KYUUBI_SESSION_USER_KEY());
+ JdbcDialect dialect = JdbcDialect.fromUrl(jdbcUrl);
+ if (dialect == null) {
+ throw new IllegalArgumentException(
+ "Invalid " + KyuubiConf.ENGINE_DATA_AGENT_JDBC_URL().key());
+ }
+ LOG.info("Data Agent JDBC datasource configured ({})",
dialect.datasourceName());
+
+ // For Kyuubi/HiveServer2 backends, pass the session user for proxy-user
impersonation —
+ // but only when the URL does not already carry explicit credentials,
because URL-supplied
+ // credentials should win (some users pass credentials via session
variables).
+ String subprotocol = JdbcDialect.extractSubprotocol(jdbcUrl);
+ boolean isKyuubiBackend = "kyuubi".equals(subprotocol) ||
"hive2".equals(subprotocol);
+ String hikariUser = null;
+ if (isKyuubiBackend && !hasKyuubiUrlCredentials(jdbcUrl)) {
+ hikariUser = ConfUtils.optionalString(conf,
KyuubiReservedKeys.KYUUBI_SESSION_USER_KEY());
+ }
- DataSource ds = DataSourceFactory.create(jdbcUrl, sessionUser);
+ DataSource ds = DataSourceFactory.create(jdbcUrl, hikariUser);
Review Comment:
for kerberized cases, the engine process runs under kyuubi server's host and
same user, then the super user's TGT (allows proxying any users) is visible to
this process, so this would lead to arbitrary user impersonation
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
