VenuReddy2103 opened a new pull request, #6914:
URL: https://github.com/apache/hive/pull/6914
### What changes were proposed in this pull request?
Add TLS client authentication (mutual TLS) to all Hive Metastore server
endpoints, and let Metastore clients present a client certificate.
**Server side**
- New `hive.metastore.ssl.client.auth` (`NONE` default, `WANT`, `NEED`),
applied to binary Thrift, Thrift over HTTP and the servlet server (e.g. Iceberg
REST catalog, property servlet).
- New server truststore used to verify client certificates:
`hive.metastore.server.truststore.{path,password,type}` and
`hive.metastore.server.trustmanagerfactory.algorithm`. Required for
`WANT`/`NEED`; not read for `NONE`.
**Client side**
- New client keystore: `hive.metastore.client.keystore.{path,password,type}`
and `hive.metastore.client.keymanagerfactory.algorithm`, used by
`ThriftHiveMetaStoreClient` (binary and HTTP) and `HMSClient`. The certificate
is only sent when the server requests.
-
### Why are the changes needed?
HMS supports server-side TLS only. Clients verify the server, but the server
cannot authenticate clients at the TLS layer. The client keystore is separate
from `hive.metastore.keystore.*` because that keystore is the server identity.
With CAs issuing single-purpose certificates(serverAuth-only or clientAuth-only
EKU), the server certificate cannot be used as a client certificate.
### Does this PR introduce _any_ user-facing change?
Yes, added new configuration. The default behavior is unchanged. With
`hive.metastore.ssl.client.auth=NONE`, HMS behaves as before (one-way TLS), and
the server truststore is not read.
### How was this patch tested?
Verified manually with all 3 `hive.metastore.ssl.client.auth` modes
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
