2b67ab6e69
### _Why are the changes needed?_ To fix the config name and placeholder with `username` introduced in https://github.com/apache/incubator-kyuubi/pull/3235 violate this convention as in JDBC driver use `user` keyword used for connection user rather than `username`, 1. change config name from `kyuubi.authentication.jdbc.username` to `kyuubi.authentication.jdbc.user` 2. change placeholder from `${username}` to `${user}` 3. update docs and config description related to above changes, and sync the update in jdbc auth docs statement details to config docs. 4. fix error in throwing AuthenticationException with auth db password. ut added for the fix. 5. other minor update in docs of custom auth ### _How was this patch tested?_ - [x] Add some test cases that check the changes thoroughly including negative and positive cases if possible - [ ] Add screenshots for manual tests if appropriate - [x] [Run test](https://kyuubi.apache.org/docs/latest/develop_tools/testing.html#running-tests) locally before make a pull request Closes #3288 from bowenliang123/jdbc-auth-config-update. Closes #3222 502703fb [Bowen Liang] skip map for placeholder value lookup 3733be41 [liangbowen] nit ab00525b [liangbowen] nit 2301c4f0 [liangbowen] fix ut of jdbc auth with wrong_password 06f0c1bb [liangbowen] remove redundant docs ec4565b3 [liangbowen] remove redundant docs ae1cce2e [liangbowen] fix compilation error of configLog 5d14103b [liangbowen] simplify configLog 6678e657 [liangbowen] reformat 52c1038e [liangbowen] simplify placeholder checking 21c2d5ea [liangbowen] check whether placeholders in supported list before conn establishment or authenticate 7db0adf5 [liangbowen] ut for unknown placeholder 657de6af [liangbowen] nit 736b3f22 [liangbowen] refactoring placeholder value lookup, for preventing setString multiple times with "i+1" 86c89125 [liangbowen] setMaxRows after prepare placeholder, to postpone operation on jdbc conn 115fae50 [liangbowen] increase test code coverage b45b28cb [liangbowen] resultSet returned by executeQuery is never null e1c07274 [liangbowen] update ut for redactPassword in JdbcUtils b4a52e29 [liangbowen] fix typo in docs of custom auth 371c2c6e [liangbowen] move redactPassword method to JdbcUtils and add ut. a4973c59 [liangbowen] reformat code 486e1503 [liangbowen] fix error in throwing AuthenticationException with auth db password. add ut for the fix. efced90a [liangbowen] update settings.md ef97e354 [liangbowen] add SELECT prefix hint for doc of kyuubi.authentication.jdbc.query 025f94c7 [liangbowen] fix username to user in JdbcAuthenticationProviderImpl by 1. use config name `kyuubi.authentication.jdbc.user`, 2. use ${user} placeholder instead of ${username} Lead-authored-by: liangbowen <liangbowen@gf.com.cn> Co-authored-by: Bowen Liang <liangbowen@gf.com.cn> Signed-off-by: Cheng Pan <chengpan@apache.org>
83 lines
3.0 KiB
ReStructuredText
83 lines
3.0 KiB
ReStructuredText
.. Licensed to the Apache Software Foundation (ASF) under one or more
|
|
contributor license agreements. See the NOTICE file distributed with
|
|
this work for additional information regarding copyright ownership.
|
|
The ASF licenses this file to You under the Apache License, Version 2.0
|
|
(the "License"); you may not use this file except in compliance with
|
|
the License. You may obtain a copy of the License at
|
|
|
|
.. http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
.. Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
|
|
Configure Kyuubi to use Custom Authentication
|
|
=============================================
|
|
|
|
Besides the `builtin authentication`_ methods, kyuubi supports custom
|
|
authentication implementations of `org.apache.kyuubi.service.authentication.PasswdAuthenticationProvider`.
|
|
|
|
.. code-block:: scala
|
|
|
|
package org.apache.kyuubi.service.authentication
|
|
|
|
import javax.security.sasl.AuthenticationException
|
|
|
|
trait PasswdAuthenticationProvider {
|
|
|
|
/**
|
|
* The authenticate method is called by the Kyuubi Server authentication layer
|
|
* to authenticate users for their requests.
|
|
* If a user is to be granted, return nothing/throw nothing.
|
|
* When a user is to be disallowed, throw an appropriate [[AuthenticationException]].
|
|
*
|
|
* @param user The username received over the connection request
|
|
* @param password The password received over the connection request
|
|
*
|
|
* @throws AuthenticationException When a user is found to be invalid by the implementation
|
|
*/
|
|
@throws[AuthenticationException]
|
|
def authenticate(user: String, password: String): Unit
|
|
}
|
|
|
|
Build A Custom Authenticator
|
|
----------------------------
|
|
|
|
To create custom Authenticator class derived from the above interface, we need to:
|
|
|
|
- Referencing the library
|
|
|
|
.. code-block:: xml
|
|
|
|
<dependency>
|
|
<groupId>org.apache.kyuubi</groupId>
|
|
<artifactId>kyuubi-common_2.12</artifactId>
|
|
<version>1.5.2-incubating</version>
|
|
<scope>provided</scope>
|
|
</dependency>
|
|
|
|
- Implement PasswdAuthenticationProvider - `Sample Code`_
|
|
|
|
|
|
Enable Custom Authentication
|
|
----------------------------
|
|
|
|
To enable the custom authentication method, we need to
|
|
|
|
- Put the jar package to ``$KYUUBI_HOME/jars`` directory to make it visible for
|
|
the classpath of the kyuubi server.
|
|
- Configure the following properties to ``$KYUUBI_HOME/conf/kyuubi-defaults.conf``
|
|
on each node where kyuubi server is installed.
|
|
|
|
.. code-block:: property
|
|
:margin:
|
|
|
|
kyuubi.authentication=CUSTOM
|
|
kyuubi.authentication.custom.class=YourAuthenticationProvider
|
|
|
|
- Restart all the kyuubi server instances
|
|
|
|
.. _builtin authentication: ../../security/authentication.html
|
|
.. _Sample Code: https://github.com/kyuubilab/example-custom-authentication/blob/main/src/main/scala/org/apache/kyuubi/example/MyAuthenticationProvider.scala |