fix: make auth for hive optional #10172
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This will make allow the admin to setup a root connection which can be impersonated.
villebro
approved these changes
Jun 26, 2020
john-bodley
reviewed
Jun 26, 2020
john-bodley
approved these changes
Jun 26, 2020
auxten
pushed a commit
to auxten/incubator-superset
that referenced
this pull request
Nov 20, 2020
* fix: make auth for hive optional This will make allow the admin to setup a root connection which can be impersonated. * style: black lint conform * style: clean up unnecessary condition expansion
mistercrunch
added
🏷️ bot
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This will make allow the admin to set up a root connection that can be impersonated.
SUMMARY
If a root Hive connection is used liked in Hue, we want to simply impersonate that single connection to allow Apache Sentry/Ranger to manage user rights regarding databases/tables. If we enforce the auth param, we also are forced to set credentials on that connection, although we want to use a dedicated hive-server and connection in combination with Apache Sentry/Range, similar to Hue.
BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
TEST PLAN
Set up an unprotected Hive server and add that connection.
Select impersonation.
Without the auth flags (eG the submitted fix) Superset is able to impersonate the connection properly.
If the auth setting is set (eG to LDAP or Kerberos) Superset expects username:password in the connection string, although it is not required.
To verify the correct behavior, set the connection, check impersonation, and do not modify the
Extrasettings.An open connection should still be able to impersonate the connection.
ADDITIONAL INFORMATION
User Impersonation Documentation/Example #8406 (unsolved)