Gabriel39 opened a new pull request, #69598:
URL: https://github.com/apache/doris/pull/69598
### What problem does this PR solve?
Issue Number: N/A
Iceberg catalogs configured with `hdfs.authentication.*` can fail against
secured HDFS with `Client cannot authenticate via:[TOKEN, KERBEROS]`. Storage
binding already translates these properties into Hadoop configuration, but
plugin-side authenticator selection checks only the raw legacy
`hadoop.security.authentication` key and skips the Kerberos identity.
Select the storage authenticator from the merged Hadoop configuration used
by FileIO, matching the Paimon connector. Keep HMS authentication separate. Add
a canonical-property unit test and an HMS/storage identity separation check,
and switch the existing Kerberos regression suite to canonical storage
properties so its read/write, rollback, and snapshot-expiration coverage
exercises this path.
### Release note
Iceberg catalogs honor canonical HDFS Kerberos authentication properties for
plugin-side file access.
### Check List (For Author)
- Test
- [x] Unit Test: the new canonical-property test fails before the fix;
all 12 authenticator tests pass afterward.
- [x] Unit Test: the complete Iceberg module reports 1739 tests, 0
failures, 0 errors, and 14 skipped; upstream reactor module tests also pass.
- [ ] Regression test: updated `test_iceberg_hadoop_catalog_kerberos`;
the Kerberos end-to-end suite was not run locally.
- [x] FE Checkstyle: all 88 reactor modules pass `mvn -f fe/pom.xml
checkstyle:check`.
- Behavior changed:
- [x] Yes. Canonical HDFS Kerberos properties now select the plugin-side
storage authenticator.
- Does this need documentation?
- [x] No. This restores the existing properties' documented behavior.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
