Gabriel39 commented on code in PR #69598:
URL: https://github.com/apache/doris/pull/69598#discussion_r4375736328
##########
fe/fe-connector/fe-connector-iceberg/src/main/java/org/apache/doris/connector/iceberg/IcebergConnector.java:
##########
@@ -1454,9 +1454,11 @@ private HadoopAuthenticator pluginAuthenticator() {
*/
static HadoopAuthenticator buildPluginAuthenticator(Map<String, String>
properties,
Map<String, String> storageHadoopConfig) {
- if
("kerberos".equalsIgnoreCase(properties.get(HADOOP_SECURITY_AUTHENTICATION))) {
- return HadoopAuthenticator.getHadoopAuthenticator(
- IcebergCatalogFactory.buildHadoopConfiguration(properties,
storageHadoopConfig));
+ // Storage bindings normalize hdfs.authentication.* and XML settings
into Hadoop keys.
+ // Gating on the raw legacy key would leave FileIO using the plugin's
unauthenticated UGI.
+ Configuration conf =
IcebergCatalogFactory.buildHadoopConfiguration(properties, storageHadoopConfig);
+ if
("kerberos".equalsIgnoreCase(conf.get(HADOOP_SECURITY_AUTHENTICATION))) {
+ return HadoopAuthenticator.getHadoopAuthenticator(conf);
Review Comment:
Fixed in 53712343aaa. The selector now resolves `AuthenticationConfig` from
the merged Hadoop configuration and creates the plugin authenticator only for
`KerberosAuthenticationConfig`. A SIMPLE fallback returns null and keeps the
existing engine/storage authentication path. Added a real XML resource test
that observes the UGI through `TcclPinningConnectorContext`, verifies the
caller remains `storage-user` rather than `hadoop`, and checks delegation to
the existing scope. Also covered both incomplete principal/keytab variants
alongside the canonical positive. Both new negative tests failed before the
fix. All 14 authenticator tests and the full Iceberg module passed: 1727
passed, 14 skipped, no failures or errors. Full FE Checkstyle passed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
