question Re: Does Impala support Impersonation? in Support Questions

Does Impala support Impersonation?

RamG — Fri, 16 Sep 2022 13:13:28 GMT

Hi Guys,

I have set --authorized_proxy_user_config for required user and connecting impala using hive-jdbc url with impala.doas.user for proxy authentication but unable get expected results(getting kerberos principal user databases/results instead of proxy user databases/results). Getting same results with beeline and Java code using hive & impala drivers also.

Cluster enabled with Kerberos & Sentry & SSL & HDFS Encryption.

Please do let me know Impala does support Impersonation or not?

Thanks,

Ram G

Re: Does Impala support Impersonation?

EricL — Wed, 23 May 2018 08:19:28 GMT

No, Impala currently does not support Impersonation.

Re: Does Impala support Impersonation?

RamG — Wed, 23 May 2018 13:55:55 GMT

Thanks Eric for the confirmation.

Is there any timeline for support this?

Regards,

RamG

Re: Does Impala support Impersonation?

Romainr — Tue, 11 Sep 2018 00:32:16 GMT

It somehow does, Hue is using it, e.g. https://github.com/cloudera/hue/blob/master/apps/beeswax/src/beeswax/server/hive_server2_lib.py#L592

Re: Does Impala support Impersonation?

EricL — Tue, 11 Sep 2018 06:08:49 GMT

Hi Romain,

I think that's Hue specific setting, not Impala. The goal is to impersonate at Hue level, so instead of using "hue" to connect to Impala, it can impersonate as end user. But at impala side, query still run using "impala" user behind the scene.

There are discussions here about impersonation in Impala:
https://groups.google.com/a/cloudera.org/forum/#!topic/impala-user/2VBYXNS4ixw

Specifically:

>>> We do not plan to implement HDFS impersonation and recommend against using it for Hive as well given it's less secure and is incompatible with a fine-grained authorization.

Re: Does Impala support Impersonation?

RamG — Tue, 11 Sep 2018 16:08:40 GMT

Thank you Eric!

Re: Does Impala support Impersonation?

PyMeH — Wed, 25 Nov 2020 12:16:13 GMT

@RamG

@EricL

https://docs.cloudera.com/documentation/enterprise/latest/topics/impala_delegation.html

according to the link above Impala supports impersonation, however the client should to be using HiveServer2, not JDBC

Re: Does Impala support Impersonation?

Tim Armstrong — Mon, 30 Nov 2020 17:09:08 GMT

@PyMeH that's not right. The Impala JDBC driver does use the HS2 protocol - JDBC is the java language interface and HS2 is the client-server network protocol.

You should be able to use impersonation with JDBC. You'd need to configure Impala to allow a particular user to delegate - https://docs.cloudera.com/documentation/enterprise/latest/topics/impala_delegation.html

Then there is a DelegationUID option for the driver that I believe specifies the user to delegate to - https://docs.cloudera.com/documentation/other/connectors/impala-jdbc/latest/Cloudera-JDBC-Driver-for-Impala-Install-Guide.pdf

Re: Does Impala support Impersonation?

PyMeH — Mon, 30 Nov 2020 17:28:27 GMT

@Tim Armstrong any hints how to configure the JDBC connection to use impersonation?

Assuming I use the recommended Cloudera drivers, can you send a code snippet that invokes a simple SQL query on behalf of some user

Thanks!