Skip to content

HIVE-26723: Configurable canonical name checking. #3749

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
abstractdog merged 1 commit into from
Nov 14, 2022
Merged

HIVE-26723: Configurable canonical name checking. #3749

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 12 additions & 2 deletions jdbc/src/java/org/apache/hive/jdbc/HiveConnection.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,7 @@
import java.util.List;
import java.util.Map;
import java.util.Map.Entry;
import java.util.Optional;
import java.util.Properties;
import java.util.concurrent.Executor;
import java.util.concurrent.locks.ReentrantLock;
Expand Down Expand Up @@ -306,7 +307,11 @@ protected HiveConnection(String uri, Properties info,
sessConfMap = connParams.getSessionVars();
setupLoginTimeout();
if (isKerberosAuthMode()) {
host = Utils.getCanonicalHostName(connParams.getHost());
if (isEnableCanonicalHostnameCheck()) {
host = Utils.getCanonicalHostName(connParams.getHost());
} else {
host = connParams.getHost();
}
} else if (isBrowserAuthMode() && !isHttpTransportMode()) {
throw new SQLException("Browser auth mode is only applicable in http mode");
} else {
Expand Down Expand Up @@ -400,7 +405,7 @@ protected HiveConnection(String uri, Properties info,
}
// Update with new values
jdbcUriString = connParams.getJdbcUriString();
if (isKerberosAuthMode()) {
if (isKerberosAuthMode() && isEnableCanonicalHostnameCheck()) {
host = Utils.getCanonicalHostName(connParams.getHost());
} else {
host = connParams.getHost();
Expand Down Expand Up @@ -1324,6 +1329,11 @@ private boolean isKerberosAuthMode() {
&& sessConfMap.containsKey(JdbcConnectionParams.AUTH_PRINCIPAL);
}

private boolean isEnableCanonicalHostnameCheck() {
return Boolean.parseBoolean(
sessConfMap.getOrDefault(JdbcConnectionParams.AUTH_KERBEROS_ENABLE_CANONICAL_HOSTNAME_CHECK, "true"));
}

private boolean isBrowserAuthMode() {
return JdbcConnectionParams.AUTH_SSO_BROWSER_MODE
.equals(sessConfMap.get(JdbcConnectionParams.AUTH_TYPE));
Expand Down
1 change: 1 addition & 0 deletions jdbc/src/java/org/apache/hive/jdbc/Utils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,6 +99,7 @@ public static class JdbcConnectionParams {
public static final String AUTH_PASSWD = "password";
public static final String AUTH_KERBEROS_AUTH_TYPE = "kerberosAuthType";
public static final String AUTH_KERBEROS_AUTH_TYPE_FROM_SUBJECT = "fromSubject";
public static final String AUTH_KERBEROS_ENABLE_CANONICAL_HOSTNAME_CHECK = "kerberosEnableCanonicalHostnameCheck";
public static final String AUTH_TYPE_JWT = "jwt";
public static final String AUTH_TYPE_JWT_KEY = "jwt";
public static final String AUTH_JWT_ENV = "JWT";
Expand Down