github-actions[bot] commented on code in PR #69598:
URL: https://github.com/apache/doris/pull/69598#discussion_r4373565886
##########
fe/fe-connector/fe-connector-iceberg/src/main/java/org/apache/doris/connector/iceberg/IcebergConnector.java:
##########
@@ -1454,9 +1454,11 @@ private HadoopAuthenticator pluginAuthenticator() {
*/
static HadoopAuthenticator buildPluginAuthenticator(Map<String, String>
properties,
Map<String, String> storageHadoopConfig) {
- if
("kerberos".equalsIgnoreCase(properties.get(HADOOP_SECURITY_AUTHENTICATION))) {
- return HadoopAuthenticator.getHadoopAuthenticator(
- IcebergCatalogFactory.buildHadoopConfiguration(properties,
storageHadoopConfig));
+ // Storage bindings normalize hdfs.authentication.* and XML settings
into Hadoop keys.
+ // Gating on the raw legacy key would leave FileIO using the plugin's
unauthenticated UGI.
+ Configuration conf =
IcebergCatalogFactory.buildHadoopConfiguration(properties, storageHadoopConfig);
+ if
("kerberos".equalsIgnoreCase(conf.get(HADOOP_SECURITY_AUTHENTICATION))) {
+ return HadoopAuthenticator.getHadoopAuthenticator(conf);
Review Comment:
[P2] Preserve the storage identity when XML Kerberos falls back to SIMPLE
For a SIMPLE HDFS catalog, `hadoop.config.resources` can load XML containing
`hadoop.security.authentication=kerberos` without a principal/keytab; storage
binding accepts this when `hdfs.authentication.type=simple`. With no raw legacy
authentication key and no `hadoop.username`, the old gate returned null and
FileIO used the ambient FE process user. The new gate instead calls
`AuthenticationConfig.getKerberosConfig`, which deliberately falls back to a
`HadoopSimpleAuthenticator` for user `hadoop` when credentials are absent.
`TcclPinningConnectorContext` runs every non-null authenticator's `doAs`, so a
warehouse accessible only to the FE account (for example, `doris` with mode
0700) now fails with permission denied as `hadoop`. An explicit catalog XML
resource need not be on the classpath, so this does not require changing the
plugin's global UGI configuration. Preserve the null path when the resolved
authentication configuration is SIMPLE, and cover this missing-credentials XML c
ase alongside the canonical positive.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
