Support Hive metastore impersonation #1441

ebyhr · 2019-09-04T15:26:07Z

...c/main/java/io/prestosql/plugin/hive/authentication/KerberosHiveMetastoreAuthentication.java

presto-hive/src/main/java/io/prestosql/plugin/hive/HiveConfig.java

electrum · 2019-09-06T04:37:13Z

Would it be sufficient to call set_ugi() after connecting to the metastore? The delegation token support says it is there for map/reduce tasks, where the tasks would run on a different machine (and thus wouldn't have access to the original credentials).

ebyhr · 2019-09-06T16:25:57Z

Thank you for the advise. I think it's sufficient too and replaced the delegation token logic with set_ugi().

AnupGS · 2019-09-13T05:45:29Z

Hi, impersonation support is missed out for get table operation. is there any plan to add support for that as well?

electrum · 2019-09-16T06:52:09Z

@AnupGS What is the use case for impersonation for read calls? We could certainly add those, but I'm not aware of any reason to do so. When using SQL standard authorization, Presto performs all the security checks using the security information provided by the metastore.

findepi · 2019-09-16T07:01:31Z

@electrum this is required because HMS may impose additional checks on get_table call.
It may be, for example, that Presto user is allowed to list tables only, but it's not allowed to read from any of them.
With storage-based auth enabled in HMS, Presto user won't be able to do get_table on any table.

@ebyhr @electrum I will share with you exact impersonation rules we have implemented.

@ebyhr thanks for working on this! And apologies for not opening our impersonation impl earlier, as I promised.
It was dependent on several other changes we made.

electrum

A few minor comments, otherwise looks good. Apologies for the delay in reviewing. I'd like to merge this for the next release.

@findepi or @kokosing do you want to look at the product tests? They seem fine to me, but I'm not an expert on them.

presto-hive/src/main/java/io/prestosql/plugin/hive/metastore/thrift/ThriftHiveMetastore.java

...-hive/src/main/java/io/prestosql/plugin/hive/metastore/thrift/ThriftHiveMetastoreConfig.java

electrum · 2019-09-16T07:08:49Z

@findepi Thanks for explaining. @ebyhr It sounds like we need impersonation for the read calls. If you have time to update this PR to include those, great, otherwise we can merge this as-is and follow up with those later.

ebyhr · 2019-09-16T07:46:49Z

@findepi @electrum Thanks for your reviews and comments. I'm just adding impersonation for get_table and the dependent methods. I'll push it later.

AnupGS · 2019-09-16T11:53:19Z

Hi @electrum, @findepi has explained it perfectly. presto user is unable to get table if storage based auth is enabled.

findepi

A couple of comments. Well done!

presto-geospatial/src/test/java/io/prestosql/plugin/geospatial/TestSpatialJoins.java

presto-hive/src/main/java/io/prestosql/plugin/hive/authentication/HiveContext.java

presto-hive/src/main/java/io/prestosql/plugin/hive/metastore/HiveMetastore.java

presto-hive/src/main/java/io/prestosql/plugin/hive/metastore/cache/CachingHiveMetastore.java

presto-hive/src/main/java/io/prestosql/plugin/hive/metastore/thrift/ThriftHiveMetastore.java

presto-hive/src/main/java/io/prestosql/plugin/hive/metastore/thrift/ThriftMetastore.java

presto-product-tests/bin/product-tests-suite-3.sh

findepi · 2019-09-16T21:26:51Z

presto-product-tests/bin/product-tests-suite-5.sh

+set -xeuo pipefail
+
+presto-product-tests/bin/run_on_docker.sh \
+    singlenode-hive-impersonation \


According to https://github.com/prestosql/presto/blob/c808deea818325b300cb3d185ef1af0f7a056cd8/presto-hive/src/main/java/io/prestosql/plugin/hive/metastore/thrift/ThriftHiveMetastore.java#L144

this.impersonationEnabled = thriftConfig.isImpersonationEnabled() && hiveMetastoreAuthentication instanceof KerberosHiveMetastoreAuthentication;

the impersonation is supported only when kerberos is enabled
i think with setUGI, we should support impersonation with and without kerberos

-- but this also signals we don't have a direct test for an impersonation, something that would fail when impersonation does not work

I think this should be visible if you add authorization here. (It should be included here anyway, it contains TestRoles, this is important to run here)

findepi · 2019-09-16T21:30:50Z

When applying changes, please separate them from rebase (or delay rebase), so that the changes themselves can be viewed on GH ui.

electrum

Wow, adding impersonation for get calls was more complicated than I thought. Thanks for doing that.

presto-hive/src/main/java/io/prestosql/plugin/hive/CreateEmptyPartitionProcedure.java

presto-hive/src/main/java/io/prestosql/plugin/hive/HiveMetadata.java

presto-hive/src/main/java/io/prestosql/plugin/hive/HivePartitionManager.java

presto-hive/src/main/java/io/prestosql/plugin/hive/metastore/HivePageSinkMetadataProvider.java

presto-iceberg/src/main/java/io/prestosql/plugin/iceberg/HiveTableOperations.java

presto-iceberg/src/main/java/io/prestosql/plugin/iceberg/IcebergMetadata.java

presto-hive/src/main/java/io/prestosql/plugin/hive/metastore/thrift/ThriftHiveMetastore.java

findepi · 2019-09-17T08:43:43Z

presto-product-tests/bin/product-tests-suite-5.sh

+set -xeuo pipefail
+
+presto-product-tests/bin/run_on_docker.sh \
+    singlenode-hive-impersonation \


I think this should be visible if you add authorization here. (It should be included here anyway, it contains TestRoles, this is important to run here)

findepi · 2019-09-17T08:44:48Z

presto-product-tests/bin/product-tests-suite-5.sh

+
+presto-product-tests/bin/run_on_docker.sh \
+    singlenode-kerberos-hive-impersonation \
+    -g storage_formats,cli,hdfs_impersonation,authorization,hive_file_header


Any particular reason to include cli and hive_file_header tests?
(@kokosing do you know why do we run cli tests so often?)

No particular reason to include those tests. I followed existing hdfs-impersonation tests.

presto-product-tests/bin/product-tests-suite-5.sh

ebyhr · 2019-09-17T14:06:25Z

Let me push updated code once. Below comments are not yet applied.
#1441 (comment) & #1441 (comment)

presto-hive/src/main/java/io/prestosql/plugin/hive/HivePartitionManager.java

...to-hive/src/main/java/io/prestosql/plugin/hive/metastore/SemiTransactionalHiveMetastore.java

presto-hive/src/main/java/io/prestosql/plugin/hive/metastore/thrift/ThriftHiveMetastore.java

presto-hive/src/main/java/io/prestosql/plugin/hive/metastore/thrift/ThriftMetastoreUtil.java

ebyhr · 2019-09-19T09:50:10Z

Pushed so that we can share the current status.

presto-hive/src/main/java/io/prestosql/plugin/hive/HiveMetadataFactory.java

presto-hive/src/main/java/io/prestosql/plugin/hive/authentication/HiveIdentity.java

electrum · 2019-09-21T06:25:48Z

presto-hive/src/main/java/io/prestosql/plugin/hive/metastore/cache/CachingHiveMetastore.java

@@ -86,6 +87,7 @@
        implements HiveMetastore
 {
    protected final HiveMetastore delegate;
+    private final boolean impersonationEnabled;


We can remove this field if we add isImpersonationEnabled() to HiveMetastore. Then updateIdentity() can simply call delegate.isImpersonationEnabled().

Should we always return false in FileHiveMetastore and throw an exception in GlueHiveMetastore? At least, we can't inject ThriftHiveMetastoreConfig into FileHiveMetastore. We can do it in GlueHiveMetastore.

Yes, always false. we don't support impersonation there

presto-hive/src/main/java/io/prestosql/plugin/hive/metastore/thrift/ThriftHiveMetastore.java

electrum · 2019-09-21T06:38:43Z

I had a few comments, mostly around the usage of ThriftHiveMetastoreConfig, which is actually the cause of the Travis test failures. This should be easy to fix. After that, this PR should be ready to go. Thanks for all your hard work on this. It's much more involved than I imagined.

findepi

Minor comments.
Thanks @ebyhr

presto-hive/src/main/java/io/prestosql/plugin/hive/metastore/thrift/ThriftHiveMetastore.java

presto-hive/src/main/java/io/prestosql/plugin/hive/authentication/HiveIdentity.java

findepi · 2019-09-22T16:40:50Z

presto-hive/src/main/java/io/prestosql/plugin/hive/authentication/HiveIdentity.java

+
+    private HiveIdentity()
+    {
+        this(new ConnectorIdentity("dummy_identity", Optional.empty(), Optional.empty()));


Simply:

Suggested change

this(new ConnectorIdentity("dummy_identity", Optional.empty(), Optional.empty()));

this.username = "dummy_identity";

Still, I'd prefer the username be Optional<String> in this class.
There is only one place where getUsername() is called, so it's not a big deal and improves clarify.

findepi · 2019-09-22T16:44:02Z

presto-hive/src/main/java/io/prestosql/plugin/hive/metastore/cache/CachingHiveMetastore.java

+    private HiveIdentity updateIdentity(HiveIdentity identity)
+    {
+         // remove identity if not doing impersonation
+        return delegate.isImpersonationEnabled() ? identity : HiveIdentity.none();


HiveIdentity.none() is going to be used as a cache key many times at the same time, so using a singleton would be nice.

electrum · 2019-09-22T17:55:10Z

One more thing: we can remove AVRO_SCHEMA_URL from TestGroups in product-tests

BlueStalker · 2020-04-09T19:11:22Z

Actually I wonder how this is working, the set_ugi implementation in hive metastore server-side is like adding the user information in the session, and there is no additional impersonation or authentication implemented. In fact, the earlier version of implementation (delegation token based) looks pretty promising and follow what hive did internally. Have you guys tested this in the real secure hive metastore environment, for example, if you create a table, is it owned by the authenticated user (mostly presto) or the real impersonation user (end-user)? @ebyhr @findepi

cla-bot bot added the cla-signed label Sep 4, 2019

ebyhr force-pushed the hms-impersonation branch 2 times, most recently from a937203 to 1299349 Compare September 5, 2019 13:46

electrum reviewed Sep 6, 2019

View reviewed changes

...c/main/java/io/prestosql/plugin/hive/authentication/KerberosHiveMetastoreAuthentication.java Outdated Show resolved Hide resolved

electrum reviewed Sep 6, 2019

View reviewed changes

presto-hive/src/main/java/io/prestosql/plugin/hive/HiveConfig.java Outdated Show resolved Hide resolved

ebyhr force-pushed the hms-impersonation branch from 1299349 to 72a6bdc Compare September 6, 2019 16:11

ebyhr marked this pull request as ready for review September 7, 2019 03:53

ebyhr force-pushed the hms-impersonation branch 4 times, most recently from 75aa6e9 to d6623de Compare September 8, 2019 11:10

ebyhr requested a review from electrum September 9, 2019 06:30

dain assigned electrum Sep 9, 2019

electrum approved these changes Sep 16, 2019

View reviewed changes

ebyhr force-pushed the hms-impersonation branch from d6623de to c808dee Compare September 16, 2019 16:17

findepi self-requested a review September 16, 2019 20:53

findepi requested changes Sep 16, 2019

View reviewed changes

electrum reviewed Sep 16, 2019

View reviewed changes

findepi reviewed Sep 17, 2019

View reviewed changes

ebyhr force-pushed the hms-impersonation branch from c808dee to 525e514 Compare September 17, 2019 14:05

ebyhr commented Sep 18, 2019

View reviewed changes

presto-hive/src/main/java/io/prestosql/plugin/hive/HivePartitionManager.java Outdated Show resolved Hide resolved

ebyhr commented Sep 18, 2019

View reviewed changes

...to-hive/src/main/java/io/prestosql/plugin/hive/metastore/SemiTransactionalHiveMetastore.java Outdated Show resolved Hide resolved

ebyhr commented Sep 18, 2019

View reviewed changes

presto-hive/src/main/java/io/prestosql/plugin/hive/metastore/thrift/ThriftHiveMetastore.java Show resolved Hide resolved

ebyhr commented Sep 19, 2019

View reviewed changes

presto-hive/src/main/java/io/prestosql/plugin/hive/metastore/thrift/ThriftMetastoreUtil.java Outdated Show resolved Hide resolved

electrum reviewed Sep 21, 2019

View reviewed changes

presto-hive/src/main/java/io/prestosql/plugin/hive/HiveMetadataFactory.java Outdated Show resolved Hide resolved

electrum reviewed Sep 21, 2019

View reviewed changes

presto-hive/src/main/java/io/prestosql/plugin/hive/authentication/HiveIdentity.java Outdated Show resolved Hide resolved

electrum reviewed Sep 21, 2019

View reviewed changes

presto-hive/src/main/java/io/prestosql/plugin/hive/metastore/thrift/ThriftHiveMetastore.java Outdated Show resolved Hide resolved

electrum reviewed Sep 21, 2019

View reviewed changes

presto-hive/src/main/java/io/prestosql/plugin/hive/metastore/thrift/ThriftHiveMetastore.java Outdated Show resolved Hide resolved

ebyhr force-pushed the hms-impersonation branch 2 times, most recently from 9736171 to ed32e58 Compare September 22, 2019 02:01

findepi approved these changes Sep 22, 2019

View reviewed changes

Support Hive metastore impersonation

2f64cbf

ebyhr force-pushed the hms-impersonation branch from ed32e58 to 2f64cbf Compare September 23, 2019 15:15

electrum merged commit b5a6a8f into trinodb:master Sep 23, 2019

martint added this to the 320 milestone Oct 6, 2019

BlueStalker mentioned this pull request Apr 7, 2020

HMS Impersonation Access and breakdown metrics by hosts prestodb/presto#13699

Merged

ebyhr deleted the hms-impersonation branch April 8, 2020 02:48

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support Hive metastore impersonation #1441

Support Hive metastore impersonation #1441

ebyhr commented Sep 4, 2019 •

edited

Loading

electrum commented Sep 6, 2019

ebyhr commented Sep 6, 2019

AnupGS commented Sep 13, 2019

electrum commented Sep 16, 2019

findepi commented Sep 16, 2019

electrum left a comment

electrum commented Sep 16, 2019

ebyhr commented Sep 16, 2019

AnupGS commented Sep 16, 2019

findepi left a comment

findepi Sep 16, 2019

findepi Sep 17, 2019

findepi commented Sep 16, 2019

electrum left a comment

findepi Sep 17, 2019

findepi Sep 17, 2019

ebyhr Sep 17, 2019

ebyhr commented Sep 17, 2019

ebyhr commented Sep 19, 2019

electrum Sep 21, 2019

ebyhr Sep 21, 2019 •

edited

Loading

findepi Sep 22, 2019

electrum commented Sep 21, 2019

findepi left a comment

findepi Sep 22, 2019

findepi Sep 22, 2019

findepi Sep 22, 2019

electrum commented Sep 22, 2019

BlueStalker commented Apr 9, 2020 •

edited

Loading

	this(new ConnectorIdentity("dummy_identity", Optional.empty(), Optional.empty()));
	this.username = "dummy_identity";

Support Hive metastore impersonation #1441

Support Hive metastore impersonation #1441

Conversation

ebyhr commented Sep 4, 2019 • edited Loading

electrum commented Sep 6, 2019

ebyhr commented Sep 6, 2019

AnupGS commented Sep 13, 2019

electrum commented Sep 16, 2019

findepi commented Sep 16, 2019

electrum left a comment

Choose a reason for hiding this comment

electrum commented Sep 16, 2019

ebyhr commented Sep 16, 2019

AnupGS commented Sep 16, 2019

findepi left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

findepi commented Sep 16, 2019

electrum left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ebyhr commented Sep 17, 2019

ebyhr commented Sep 19, 2019

Choose a reason for hiding this comment

ebyhr Sep 21, 2019 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

electrum commented Sep 21, 2019

findepi left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

electrum commented Sep 22, 2019

BlueStalker commented Apr 9, 2020 • edited Loading

ebyhr commented Sep 4, 2019 •

edited

Loading

ebyhr Sep 21, 2019 •

edited

Loading

BlueStalker commented Apr 9, 2020 •

edited

Loading