This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new 45248f56e78 fix: pass through user-provided password in
HiveServer2Hook for all auth modes (#62888)
45248f56e78 is described below
commit 45248f56e78670824c2b966ffb4fbd470466fef6
Author: Yoann <[email protected]>
AuthorDate: Tue Mar 10 10:23:41 2026 -0700
fix: pass through user-provided password in HiveServer2Hook for all auth
modes (#62888)
* fix: pass through user-provided password in HiveServer2Hook regardless of
auth mechanism
Previously, HiveServer2Hook.get_conn() only set the password when
auth_mechanism was LDAP, CUSTOM, or PLAIN. For all other auth modes
(including the default NONE), user-provided passwords were silently
dropped and pyhive would default to sending 'x' as the password.
Now the password is passed through whenever the user has explicitly
set one in the connection, regardless of the configured auth mechanism.
Fixes apache/airflow#62338
* ci: retrigger CI
---
.../src/airflow/providers/apache/hive/hooks/hive.py | 7 +++++--
.../hive/tests/unit/apache/hive/hooks/test_hive.py | 21 +++++++++++++++++++++
2 files changed, 26 insertions(+), 2 deletions(-)
diff --git
a/providers/apache/hive/src/airflow/providers/apache/hive/hooks/hive.py
b/providers/apache/hive/src/airflow/providers/apache/hive/hooks/hive.py
index efa0397c0d7..e5ce0cc6047 100644
--- a/providers/apache/hive/src/airflow/providers/apache/hive/hooks/hive.py
+++ b/providers/apache/hive/src/airflow/providers/apache/hive/hooks/hive.py
@@ -885,8 +885,11 @@ class HiveServer2Hook(DbApiHook):
auth_mechanism = db.extra_dejson.get("auth_mechanism", "KERBEROS")
kerberos_service_name =
db.extra_dejson.get("kerberos_service_name", "hive")
- # Password should be set if in LDAP, CUSTOM or PLAIN mode
- if auth_mechanism in ("LDAP", "CUSTOM", "PLAIN"):
+ # Pass through the password whenever the user has explicitly set one.
+ # Previously this was restricted to LDAP/CUSTOM/PLAIN, which caused
+ # user-provided passwords to be silently dropped for other auth modes
+ # (pyhive defaults to sending "x" when password is None).
+ if db.password:
password = db.password
from pyhive.hive import connect
diff --git a/providers/apache/hive/tests/unit/apache/hive/hooks/test_hive.py
b/providers/apache/hive/tests/unit/apache/hive/hooks/test_hive.py
index 94a573a2259..1508b203012 100644
--- a/providers/apache/hive/tests/unit/apache/hive/hooks/test_hive.py
+++ b/providers/apache/hive/tests/unit/apache/hive/hooks/test_hive.py
@@ -697,6 +697,27 @@ class TestHiveServer2Hook:
database="default",
)
+ @mock.patch("pyhive.hive.connect")
+ def test_get_conn_with_password_none_auth(self, mock_connect):
+ """Test that password is passed through even when auth_mechanism is
NONE."""
+ conn_id = "conn_none_with_password"
+ conn_env = CONN_ENV_PREFIX + conn_id.upper()
+
+ with mock.patch.dict(
+ "os.environ",
+ {conn_env: "jdbc+hive2://user:mypassword@localhost:10000/default"},
+ ):
+ HiveServer2Hook(hiveserver2_conn_id=conn_id).get_conn()
+ mock_connect.assert_called_once_with(
+ host="localhost",
+ port=10000,
+ auth="NONE",
+ kerberos_service_name=None,
+ username="user",
+ password="mypassword",
+ database="default",
+ )
+
@pytest.mark.parametrize(
("host", "port", "schema", "message"),
[
