github-actions[bot] commented on code in PR #69247:
URL: https://github.com/apache/doris/pull/69247#discussion_r4309946247
##########
fe/fe-connector/fe-connector-paimon/src/main/java/org/apache/doris/connector/paimon/PaimonConnector.java:
##########
@@ -216,9 +216,11 @@ private HadoopAuthenticator pluginAuthenticator() {
*/
static HadoopAuthenticator buildPluginAuthenticator(Map<String, String>
properties,
Map<String, String> storageHadoopConfig) {
- if
("kerberos".equalsIgnoreCase(properties.get(HADOOP_SECURITY_AUTHENTICATION))) {
- return HadoopAuthenticator.getHadoopAuthenticator(
- PaimonCatalogFactory.buildHadoopConfiguration(properties,
storageHadoopConfig));
+ // Storage bindings normalize hdfs.authentication.* and XML settings
into Hadoop keys.
+ // Gating on the raw legacy key would leave FileIO using the plugin's
unauthenticated UGI.
+ Configuration conf =
PaimonCatalogFactory.buildHadoopConfiguration(properties, storageHadoopConfig);
+ if
("kerberos".equalsIgnoreCase(conf.get(HADOOP_SECURITY_AUTHENTICATION))) {
+ return HadoopAuthenticator.getHadoopAuthenticator(conf);
Review Comment:
[P2] Preserve inherited UGI when Kerberos credentials are absent
If FE's `core-site.xml` supplies `hadoop.security.authentication=kerberos`,
but the catalog has no Doris principal/keytab pair (e.g. it relies on an
existing Kerberos ticket-cache login), this new gate calls
`getHadoopAuthenticator(conf)`, which falls back to `HadoopSimpleAuthenticator`
and defaults to user `hadoop`. `TcclPinningConnectorContext` treats that
non-null result as authoritative, so FileIO initializes its [HDFS
client](https://raw.githubusercontent.com/apache/hadoop/rel/release-3.4.2/hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/DFSClient.java)
as a credential-free SIMPLE subject instead of the prior current/login UGI.
Paimon's secured wrapper is added after client construction and cannot replace
that captured RPC identity. A cold catalog access then fails against secured
HDFS; the same identity change can cause permission failures on simple HDFS.
Keep the previous null/delegate behavior when the resolved config is the SIMPLE
fallback, whi
le retaining Kerberos selection for normalized configurations with credentials.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
