From 7ea591ba3e2bf0c9ee1d939dc13719a36dd5d61e Mon Sep 17 00:00:00 2001 From: weishao Date: Fri, 21 Aug 2026 16:54:12 +0800 Subject: [PATCH 1/2] [PAIMON-9337] Support Kerberos proxy user when reading Paimon table via Hive --- .../paimon/security/KerberosLoginProvider.java | 10 ++++------ .../security/KerberosLoginProviderITCase.java | 16 ++++++++++------ 2 files changed, 14 insertions(+), 12 deletions(-) diff --git a/paimon-common/src/main/java/org/apache/paimon/security/KerberosLoginProvider.java b/paimon-common/src/main/java/org/apache/paimon/security/KerberosLoginProvider.java index 0360b6c19ca2..06f17ab1f795 100644 --- a/paimon-common/src/main/java/org/apache/paimon/security/KerberosLoginProvider.java +++ b/paimon-common/src/main/java/org/apache/paimon/security/KerberosLoginProvider.java @@ -73,7 +73,8 @@ public boolean isLoginPossible() throws IOException { return true; } } else { - throwProxyUserNotSupported(); + LOG.debug("Login from ProxyUser"); + return true; } LOG.debug("Login is NOT possible"); @@ -95,14 +96,11 @@ public void doLogin() throws IOException { UserGroupInformation.loginUserFromSubject(null); LOG.info("Loaded user's ticket cache successfully"); } else { - throwProxyUserNotSupported(); + // Proxy user: credentials are already provided by the proxy mechanism. + LOG.debug("Skipping Kerberos login for proxy user"); } } - private void throwProxyUserNotSupported() { - throw new UnsupportedOperationException("Proxy user is not supported"); - } - public static boolean isProxyUser(UserGroupInformation ugi) { return ugi.getAuthenticationMethod() == UserGroupInformation.AuthenticationMethod.PROXY; } diff --git a/paimon-common/src/test/java/org/apache/paimon/security/KerberosLoginProviderITCase.java b/paimon-common/src/test/java/org/apache/paimon/security/KerberosLoginProviderITCase.java index 0e4ec05ba44c..b894b9ff486d 100644 --- a/paimon-common/src/test/java/org/apache/paimon/security/KerberosLoginProviderITCase.java +++ b/paimon-common/src/test/java/org/apache/paimon/security/KerberosLoginProviderITCase.java @@ -37,6 +37,7 @@ import static org.mockito.ArgumentMatchers.anyString; import static org.mockito.Mockito.mock; import static org.mockito.Mockito.mockStatic; +import static org.mockito.Mockito.never; import static org.mockito.Mockito.when; /** @@ -108,7 +109,7 @@ public void isLoginPossibleMustReturnTrueWithTGT() throws IOException { } @Test - public void isLoginPossibleMustThrowExceptionWithProxyUser() { + public void isLoginPossibleMustReturnTrueWithProxyUser() { Options options = new Options(); KerberosLoginProvider kerberosLoginProvider = new KerberosLoginProvider(options); @@ -119,8 +120,7 @@ public void isLoginPossibleMustThrowExceptionWithProxyUser() { ugi.when(UserGroupInformation::isSecurityEnabled).thenReturn(true); ugi.when(UserGroupInformation::getCurrentUser).thenReturn(userGroupInformation); - assertThatThrownBy(kerberosLoginProvider::isLoginPossible) - .isInstanceOf(UnsupportedOperationException.class); + assertThat(kerberosLoginProvider.isLoginPossible()).isTrue(); } } @@ -158,7 +158,7 @@ public void doLoginMustLoginWithTGT() throws IOException { } @Test - public void doLoginMustThrowExceptionWithProxyUser() { + public void doLoginMustDoNothingWithProxyUser() { Options options = new Options(); KerberosLoginProvider kerberosLoginProvider = new KerberosLoginProvider(options); @@ -168,8 +168,12 @@ public void doLoginMustThrowExceptionWithProxyUser() { .thenReturn(UserGroupInformation.AuthenticationMethod.PROXY); ugi.when(UserGroupInformation::getCurrentUser).thenReturn(userGroupInformation); - assertThatThrownBy(kerberosLoginProvider::doLogin) - .isInstanceOf(UnsupportedOperationException.class); + // proxy user should not trigger any Kerberos login + kerberosLoginProvider.doLogin(); + ugi.verify(() -> UserGroupInformation.loginUserFromSubject(null), never()); + ugi.verify( + () -> UserGroupInformation.loginUserFromKeytab(anyString(), anyString()), + never()); } } } From 9244c4ba0f5572ccc83e456d52a3809e51f1bc9c Mon Sep 17 00:00:00 2001 From: weishao Date: Mon, 24 Aug 2026 14:40:42 +0800 Subject: [PATCH 2/2] paimon-9337 remove unused assertThatThrownBy import --- .../org/apache/paimon/security/KerberosLoginProviderITCase.java | 1 - 1 file changed, 1 deletion(-) diff --git a/paimon-common/src/test/java/org/apache/paimon/security/KerberosLoginProviderITCase.java b/paimon-common/src/test/java/org/apache/paimon/security/KerberosLoginProviderITCase.java index b894b9ff486d..53f4085a89dd 100644 --- a/paimon-common/src/test/java/org/apache/paimon/security/KerberosLoginProviderITCase.java +++ b/paimon-common/src/test/java/org/apache/paimon/security/KerberosLoginProviderITCase.java @@ -33,7 +33,6 @@ import static org.apache.paimon.security.SecurityConfiguration.KERBEROS_LOGIN_PRINCIPAL; import static org.apache.paimon.security.SecurityConfiguration.KERBEROS_LOGIN_USETICKETCACHE; import static org.assertj.core.api.Assertions.assertThat; -import static org.assertj.core.api.Assertions.assertThatThrownBy; import static org.mockito.ArgumentMatchers.anyString; import static org.mockito.Mockito.mock; import static org.mockito.Mockito.mockStatic;