Github user sohami commented on a diff in the pull request:
https://github.com/apache/drill/pull/910#discussion_r135193811
--- Diff:
exec/java-exec/src/main/java/org/apache/drill/exec/server/rest/DrillRestServer.java
---
@@ -230,6 +230,27 @@ public WebUserConnection provide() {
public void dispose(WebUserConnection instance) {
}
+
+ /**
+ * Creates session user principal. If impersonation is enabled without
authentication and User-Name header is present and valid,
+ * will create session user principal with provided user name,
otherwise anonymous user name will be used.
+ * In both cases session user principal will have admin rights.
+ *
+ * @param config drill config
+ * @param request client request
+ * @return session user principal
+ */
+ private Principal createSessionUserPrincipal(DrillConfig config,
HttpServletRequest request) {
+ final boolean checkForUserName =
!config.getBoolean(ExecConstants.USER_AUTHENTICATION_ENABLED) &&
config.getBoolean(ExecConstants.IMPERSONATION_ENABLED);
+ if (checkForUserName) {
--- End diff --
In this case it should be enforced that the _User-Name_ is provided in
header when used via REST API and from WebUI. Falling back to _anonymous_ user
will not help since it will fail during query execution as there won't be any
valid user with name _anonymous_ on server side.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at [email protected] or file a JIRA ticket
with INFRA.
---
