zhuangchong opened a new issue #4450:
URL: https://github.com/apache/incubator-dolphinscheduler/issues/4450
**Describe the bug**
Hive/Spark JDBC supports manual configuration of keytab parameters when
using Kerberos authentication, and supports multi-tenancy when using Kerberos
authentication for Hive/Spark data sources.
The current Hive/Spark JDBC system uses Kerberos authentication using the
keytab configured in the common.properties file. There is a problem when
Hive/Spark data source Kerberos authenticates other users or multiple different
users.
**To Reproduce**
1.common.properties configuration keytab file is for the DolphinScheduler
tenant;
2.Hive DataSource Kerberos authenticated tenants are hive_exec_1 tenants;
3.Use the above Hive data source query to report no permissions;
**Which version of Dolphin Scheduler:**
-[dev]
**Requirement or improvement**
Improvement: Add Kerberos-related parameters to the other parameters or
principal parameters section of the DataSource page for manual input by the user
**Additional context**
Points needing attention:
Kerberos expiration issue (I don't think this Kerberos expiration is related
to scheduling, we will consider whether to deal with this later)
Solution 1:
Execute the script kinit-kt/XXX /xxx.keytab [email protected] using the shell
task node, and set the keytab to be swipe regularly
If you have any good ideas, please leave a message!
---
**描述错误**
Hive/Spark JDBC
使用Kerberos认证时支持keytab相关参数手动配置，解决Hive/Spark数据源开启Kerberos认证时支持多租户。
当前系统Hive/Spark JDBC
使用Kerberos认证时使用的都是Common.properties文件内配置的keytab,当Hive/Spark数据源kerberos认证其他用户或多个不同的用户是存在问题的。
**To Reproduce**
1.common.properties 配置 keytab文件 是dolphinscheduler租户的；
2.hive datasource kerberos认证租户是 hive_exec_1租户的；
3.使用上面的hive数据源查询语句会报没有权限；
**要求或改进**
改进：在datasource页面其他参数或principal参数部分新增kerberos相关参数，供用户手动输入
**Additional context**
需要注意的点：
kerberos过期问题（我认为这个kerberos过期和调度无关，这块后面在考虑要不要处理）
解决方案一：
使用shell任务节点执行 kinit-kt/XXX /xxx.keytab [email protected] 脚本，设置定时刷keytab
你有什么好的想法，欢迎留言！
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
