[feat][PES][datasource] add hive datasource sharing with kerberos keytab for non-creator users

linkis-public-enhancements/linkis-datasource/linkis-metadata-query/server/src/main/java/org/apache/linkis/metadata/query/server/service/impl/MetadataQueryServiceImpl.java

@@ -452,7 +452,8 @@ public DsInfoResponse reqToGetDataSourceInfo(String dataSourceId, String system,
       boolean hasPermission =
           (AuthContext.isAdministrator(userName)
               || (StringUtils.isNotBlank(response.getCreator())
-                  && userName.equals(response.getCreator())));
+                  && userName.equals(response.getCreator()))
+              || isHiveShareEnabled(response.getDsType()));
       if (!hasPermission) {
         throw new ErrorException(-1, "Don't have query permission for data source [没有数据源的查询权限]");
       } else if (response.getParams().isEmpty()) {
@@ -511,7 +512,8 @@ public DsInfoResponse queryDataSourceInfoByNameAndEnvId(
       boolean hasPermission =
           (AuthContext.isAdministrator(userName)
               || (StringUtils.isNotBlank(response.getCreator())
-                  && userName.equals(response.getCreator())));
+                  && userName.equals(response.getCreator()))
+              || isHiveShareEnabled(response.getDsType()));
       if (!hasPermission) {
         throw new ErrorException(-1, "Don't have query permission for data source [没有数据源的查询权限]");
       } else if (!useDefault && response.getParams().isEmpty()) {
@@ -541,6 +543,23 @@ private DsInfoResponse reqGetDefaultDataSource(String dataSourceName) {
         : null;
   }
 
+  /**
+   * Check if Hive datasource share is enabled for the given datasource type. When the switch is on
+   * and the datasource type is "hive", non-creator users are allowed to query the datasource.
+   *
+   * @param dsType datasource type
+   * @return true if Hive share is enabled and the type is hive
+   */
+  private boolean isHiveShareEnabled(String dsType) {
+    boolean shareEnabled = MdmConfiguration.HIVE_DATASOURCE_SHARE_ENABLE.getValue();
+    if (shareEnabled && "hive".equalsIgnoreCase(dsType)) {
+      logger.info(
+          "Hive datasource share is enabled, allowing access for non-creator user to hive datasource");
+      return true;
+    }
+    return false;
+  }
+
   /**
    * Invoke method in meta service
    *

linkis-public-enhancements/linkis-datasource/linkis-metadata-query/service/hive/src/main/java/org/apache/linkis/metadata/query/service/HiveMetaService.java

@@ -22,6 +22,7 @@
 import org.apache.linkis.bml.protocol.BmlDownloadResponse;
 import org.apache.linkis.common.conf.CommonVars;
 import org.apache.linkis.datasourcemanager.common.util.json.Json;
+import org.apache.linkis.metadata.query.common.MdmConfiguration;
 import org.apache.linkis.metadata.query.common.domain.MetaColumnInfo;
 import org.apache.linkis.metadata.query.common.domain.MetaPartitionInfo;
 import org.apache.linkis.metadata.query.common.exception.MetaRuntimeException;
@@ -83,10 +84,36 @@ public MetadataConnection<HiveConnection> getConnection(
       LOG.info("Try to connect Hive MetaStore in kerberos with principle:[" + principle + "]");
       String keytabResourceId =
           String.valueOf(params.getOrDefault(HiveParamsMapper.PARAM_HIVE_KEYTAB.getValue(), ""));
-      if (StringUtils.isNotBlank(keytabResourceId)) {
+
+      boolean hiveShareEnabled = MdmConfiguration.HIVE_DATASOURCE_SHARE_ENABLE.getValue();
+      String keytabFilePath;
+
+      if (hiveShareEnabled && StringUtils.isNotBlank(principle)) {
+        // When Hive datasource share is enabled, use local keytab path instead of BML download
+        // Extract primary from principal (e.g., "hadoop" from "hadoop@REALM" or
+        // "hadoop/host@REALM")
+        String principalPrimary = principle.split("/")[0].split("@")[0];
+        String keytabDir = MdmConfiguration.HIVE_DATASOURCE_SHARE_KEYTAB_PATH.getValue();
+        keytabFilePath = keytabDir + principalPrimary + ".keytab";
+        LOG.info(
+            "Hive datasource share is enabled, using local keytab path:["
+                + keytabFilePath
+                + "] for principal:["
+                + principle
+                + "]");
+        File keytabFile = new File(keytabFilePath);
+        if (!keytabFile.exists()) {
+          throw new MetaRuntimeException(
+              "Local keytab file not found:["
+                  + keytabFilePath
+                  + "], please ensure the keytab file is placed correctly",
+              null);
+        }
+      } else if (StringUtils.isNotBlank(keytabResourceId)) {
+        // Original behavior: download keytab from BML
         FileUtils.forceMkdir(new File(TMP_FILE_STORE_LOCATION.getValue()));
         LOG.info("Start to download resource id:[" + keytabResourceId + "]");
-        String keytabFilePath =
+        keytabFilePath =
             TMP_FILE_STORE_LOCATION.getValue()
                 + "/"
                 + UUID.randomUUID().toString().replace("-", "")
@@ -96,10 +123,10 @@ public MetadataConnection<HiveConnection> getConnection(
           throw new MetaRuntimeException(
               "Fail to download resource i:[" + keytabResourceId + "]", null);
         }
-        conn = new HiveConnection(uris, principle, keytabFilePath, getExtraHadoopConf(params));
       } else {
         throw new MetaRuntimeException("Cannot find the keytab file in connect parameters", null);
       }
+      conn = new HiveConnection(uris, principle, keytabFilePath, getExtraHadoopConf(params));
     } else {
       conn = new HiveConnection(uris, getExtraHadoopConf(params));
     }

linkis-public-enhancements/linkis-datasource/linkis-metadata-query/service/jdbc/src/main/java/org/apache/linkis/metadata/query/service/db2/SqlConnection.java

@@ -47,7 +47,7 @@ public class SqlConnection implements Closeable {
   private static final CommonVars<String> SQL_SCHEMA_QUERY =
       CommonVars.apply(
           "wds.linkis.server.mdm.service.db2.schema.query.sql",
-          "SELECT SCHEMANAME FROM SYSCAT.SCHEMATA WHERE SCHEMANAME NOT LIKE 'SYS%' AND SCHEMANAME NOT IN ('NULLID', 'SQLJ') WITH UR");
+          "SELECT TRIM(SCHEMANAME) FROM SYSCAT.SCHEMATA WHERE SCHEMANAME NOT LIKE 'SYS%' AND SCHEMANAME NOT IN ('NULLID', 'SQLJ') WITH UR");
 
   private Connection conn;
 

linkis-public-enhancements/linkis-pes-common/src/main/java/org/apache/linkis/datasourcemanager/common/auth/AuthContext.java

@@ -19,6 +19,7 @@
 
 import org.apache.linkis.common.conf.CommonVars;
 import org.apache.linkis.datasourcemanager.common.domain.DataSource;
+import org.apache.linkis.metadata.query.common.MdmConfiguration;
 
 import org.apache.commons.lang3.StringUtils;
 
@@ -50,6 +51,12 @@ public class AuthContext {
   public static boolean hasPermission(DataSource dataSource, String username) {
     if (Objects.nonNull(dataSource)) {
       String creator = dataSource.getCreateUser();
+      if (MdmConfiguration.HIVE_DATASOURCE_SHARE_ENABLE.getValue()) {
+        String name = dataSource.getDataSourceType().getName();
+        if ("hive".equals(name)) {
+          return true;
+        }
+      }
       return (administrators.contains(username)
           || (StringUtils.isNotBlank(creator) && username.equals(creator)));
     }

linkis-public-enhancements/linkis-pes-common/src/main/java/org/apache/linkis/metadata/query/common/MdmConfiguration.java

@@ -26,4 +26,15 @@ public class MdmConfiguration {
 
   public static CommonVars<String> DATA_SOURCE_SERVICE_APPLICATION =
       CommonVars.apply("wds.linkis.server.dsm.app.name", "linkis-ps-data-source-manager");
+
+  /**
+   * Feature switch for Hive datasource sharing. When enabled, non-creator users can query Hive
+   * datasource.
+   */
+  public static CommonVars<Boolean> HIVE_DATASOURCE_SHARE_ENABLE =
+      CommonVars.apply("linkis.datasource.hive.share.enable", false);
+
+  /** Local keytab directory path for Hive datasource sharing (used when share is enabled). */
+  public static CommonVars<String> HIVE_DATASOURCE_SHARE_KEYTAB_PATH =
+      CommonVars.apply("linkis.datasource.hive.share.keytab.path", "/appcom/keytab/");
 }