Skip to content

[feat][PES][datasource] add hive datasource sharing with kerberos keytab for non-creator users - #1091

Merged
casionone merged 1 commit into
dev-2.1.0-webankfrom
dev-2.1.0-hive-share
Aug 12, 2026
Merged

[feat][PES][datasource] add hive datasource sharing with kerberos keytab for non-creator users#1091
casionone merged 1 commit into
dev-2.1.0-webankfrom
dev-2.1.0-hive-share

Conversation

@v-kkhuang

Copy link
Copy Markdown

What is the purpose of the change

Background/Problem:
Currently, Hive datasources configured with Kerberos authentication can only be queried by the datasource creator or administrators. In multi-tenant scenarios where a shared Kerberos keytab is already available on the server, other users still cannot access the same Hive datasource without re-creating it and uploading their own keytab, resulting in duplicated configuration and operational overhead.

Purpose of Change:
To address this problem, this PR adds a feature switch linkis.datasource.hive.share.enable (default off) that allows non-creator users to query Hive datasources. When enabled, the system uses a local keytab file (located at linkis.datasource.hive.share.keytab.path, derived from the principal name) instead of downloading the keytab from BML, and the permission checks in MetadataQueryServiceImpl and AuthContext are relaxed for Hive datasources.

Value/Impact:
After the change, operators can share a single Hive datasource across users by placing a shared keytab on the server and enabling the switch, reducing duplicated configuration and simplifying multi-tenant Hive metadata access. The switch defaults to off, so existing behavior is unchanged when disabled.

Related issues/PRs

Related issues: close #1090
Related pr:none

Brief change log

  • Add linkis.datasource.hive.share.enable and linkis.datasource.hive.share.keytab.path switches in MdmConfiguration
  • Use local keytab path derived from principal when share is enabled in HiveMetaService, fallback to BML download when disabled
  • Relax permission checks to allow non-creator users to query Hive datasources in MetadataQueryServiceImpl and AuthContext
  • Fix DB2 schema query to trim schema names with TRIM(SCHEMANAME)

Checklist

  • I have read the Contributing Guidelines on pull requests.
  • I have explained the need for this PR and the problem it solves
  • I have explained the changes or the new features added to this PR
  • I have added tests corresponding to this change
  • I have updated the documentation to reflect this change
  • I have verified that this change is backward compatible
  • If this is a code change: I have written unit tests to fully verify the new behavior.

@v-kkhuang v-kkhuang added the enhancement New feature or request label Aug 12, 2026

@casionone casionone left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

@casionone
casionone merged commit a0db054 into dev-2.1.0-webank Aug 12, 2026
10 of 16 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants