Mailing-List: contact issues-help@ambari.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@ambari.apache.org
Date: Mon, 1 May 2017 21:11:04 +0000 (UTC)
From: "Hudson (JIRA)" <jira@apache.org>
To: issues@ambari.apache.org
Message-ID: <JIRA.13063863.1492105961000.94961.1493673064182@Atlassian.JIRA>
In-Reply-To: <JIRA.13063863.1492105961000@Atlassian.JIRA>
References: <JIRA.13063863.1492105961000@Atlassian.JIRA> <JIRA.13063863.1492105961250@jira-lw-us.apache.org>
Subject: [jira] [Commented] (AMBARI-20760) After pam setup- Hive View user
 home test fails
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
archived-at: Mon, 01 May 2017 21:11:11 -0000


    [ https://issues.apache.org/jira/browse/AMBARI-20760?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15991531#comment-15991531 ] 

Hudson commented on AMBARI-20760:
---------------------------------

FAILURE: Integrated in Jenkins build Ambari-trunk-Commit #7399 (See [https://builds.apache.org/job/Ambari-trunk-Commit/7399/])
AMBARI-20760. After pam setup- Hive View user home test fails (Anita (rlevas: [http://git-wip-us.apache.org/repos/asf?p=ambari.git&a=commit&h=f167236c24501a0d14afccfbc53a2c648cb21731])
* (edit) ambari-server/src/test/java/org/apache/ambari/server/security/authorization/AmbariPamAuthenticationProviderTest.java
* (edit) ambari-server/src/main/java/org/apache/ambari/server/security/authorization/AmbariPamAuthenticationProvider.java


> After pam setup- Hive View user home test fails
> -----------------------------------------------
>
>                 Key: AMBARI-20760
>                 URL: https://issues.apache.org/jira/browse/AMBARI-20760
>             Project: Ambari
>          Issue Type: Bug
>          Components: ambari-server
>    Affects Versions: trunk
>            Reporter: Anita Gnanamalar Jebaraj
>            Assignee: Anita Gnanamalar Jebaraj
>         Attachments: AMBARI-20760.patch, AMBARI-20760-updated.patch, error.PNG
>
>
> After setting up PAM, tried to login as PAM user and access hive view, user home test fails with the error as in screen shot.
> This issue was pointed out by [~hkropp] in the jira AMBARI-12263, but was not incorporated in the code. Pasting the comment from Henning below.
> Something we noticed is that in a secured cluster we have issues with the views, getting the following exception for the Hive view as an example:
> Struct:TOpenSessionResp(status:TStatus(statusCode:ERROR_STATUS, infoMessages:[*org.apache.hive.service.cli.HiveSQLException:Failed to validate proxy privilege of ambari for org.apache.ambari.server.security.authorization.AmbariPamAuthenticationProvider$1@34511119:33:32, 
> .....
> sqlState:08S01, errorCode:0, errorMessage:Failed to validate proxy privilege of ambari for org.apache.ambari.server.security.authorization.AmbariPamAuthenticationProvider$1@34511119), serverProtocolVersion:null)
> As you can see it tries to impersonte "org.apache.ambari.server.security.authorization.AmbariPamAuthenticationProvider$1@34511119:33:32". Changing the UsernamePasswordAuthenticationToken from Principal to username fixes this.
> So instead of :
> UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(principal, null, userAuthorities);
> We use:
> UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(user.getUserName(), null, userAuthorities);
> What could potential also work is, overriding toString of the principal like:
> Principal principal = new Principal() {
>                     @Override
>                     public String getName() {
>                         return user.getUserName();
>                     }
>                     @Override
>                     public String toString(){
>                         return user.getUserName().toString();
>                     }
>                 };
> We did not test this!
> As a little side note, I notices you are using String concatenation in your error logging like this: LOG.error("Message"+ ex.getMessage()) I think the public void error(String msg, Throwable t); interface would be preferable in such scenarios, so: LOG.error("Message", ex)


--
This message was sent by Atlassian JIRA
(v6.3.15#6346)