kyuubi/kyuubi-hive-jdbc
pengqli 9f6be0854b
[KYUUBI #5709] Avoid exposing client keystore and truststore passwords in the JDBC URL
# 🔍 Description
## Issue References 🔗

This pull request fixes #5709

## Describe Your Solution 🔧

Add a new JDBC URL property, storePasswordPath, which points to a local JCE keystore file storing password aliases.If the password exists, use password. If it does not exist, try to use storePasswordPath. All these passwords can be hidden from the JDBC URL when you protect them in a local JCEKS keystore file and pass the JCEKS file path to the URL.
JDBC URL:
`jdbc:hive2://wapdfwudp001.webex.com:30009/default;ssl=true;sslTrustStore=kyuubissl.truststore.keystore.jks;storePasswordPath=jceks://file/client_trust_creds.jceks`

Hadoop credential command with trustStorePassword and keyStorePassword aliases like below
hadoop credential create ssl.kyuubi.trustStorePassword -value mytruststorepassword -provider localjceks://file/client_trust_creds.jceks
more info: https://cwiki.apache.org/confluence/display/Hive/HiveServer2+Clients
Reference PR comes from HIVE-27308

## Types of changes 🔖

- [ ] Bugfix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing functionality to change)

## Test Plan 🧪

#### Behavior Without This Pull Request ⚰️

#### Behavior With This Pull Request 🎉

#### Related Unit Tests
Local test passed
<img width="1093" alt="Screenshot 2023-11-16 at 10 43 03" src="https://github.com/apache/kyuubi/assets/43336508/3be87238-dfd7-4484-8945-e62780c43d9a">

---

# Checklists
## 📝 Author Self Checklist

- [ ] My code follows the [style guidelines](https://kyuubi.readthedocs.io/en/master/contributing/code/style.html) of this project
- [ ] I have performed a self-review
- [ ] I have commented my code, particularly in hard-to-understand areas
- [ ] I have made corresponding changes to the documentation
- [ ] My changes generate no new warnings
- [ ] I have added tests that prove my fix is effective or that my feature works
- [ ] New and existing unit tests pass locally with my changes
- [ ] This patch was not authored or co-authored using [Generative Tooling](https://www.apache.org/legal/generative-tooling.html)

## 📝 Committer Pre-Merge Checklist

- [x] Pull request title is okay.
- [x] No license issues.
- [x] Milestone correctly set?
- [ ] Test coverage is ok
- [x] Assignees are selected.
- [x] Minimum number of approvals
- [x] No changes are requested

**Be nice. Be informative.**

Closes #5710 from dev-lpq/enhance_url_password.

Closes #5709

98cba7ef4 [pengqli] resolve conflicts
1055dcc41 [pengqli] use reflection to check Hadoop classes
c3096146d [pengqli] use reflection to check Hadoop classes
f94f3024b [pengqli] Enhanced URL password

Authored-by: pengqli <pengqli@cisco.com>
Signed-off-by: Cheng Pan <chengpan@apache.org>
2023-12-11 00:01:03 +08:00
..
src [KYUUBI #5709] Avoid exposing client keystore and truststore passwords in the JDBC URL 2023-12-11 00:01:03 +08:00
pom.xml [KYUUBI #5783] Switch to kyuubi-relocated-hive-service-rpc 2023-12-07 19:55:10 +08:00
README.md [KYUUBI #4312] [DOCS] Include **/README.md in markdown style check 2023-02-14 02:23:32 +08:00

Kyuubi Hive JDBC Module

Aiming to make a better supported client for Kyuubi and Spark

  • Add catalog to getTables meta function for DataLakes (DONE, broken in v1.3.0-incubating, fixed in v1.3.1-incubating)
  • Deploy to maven central (DONE, available since v1.3.0-incubating)
  • Create shaded jar (DONE, available since v1.4.0-incubating)
  • Remove Hive dependencies (DONE, available since v1.6.0-incubating)