private String getProxyUser ( String realUser , Map < String , String > sessionConf , String ipAddress ) throws HiveSQLException { String proxyUser = null ; // Http transport mode. // We set the thread local proxy username, in ThriftHttpServlet. if ( cliService . getHiveConf ( ) . getVar ( ConfVars . HIVE_SERVER2_TRANSPORT_MODE ) . equalsIgnoreCase ( "http" ) ) { proxyUser = SessionManager . getProxyUserName ( ) ; LOG . debug ( "Proxy user from query string: " + proxyUser ) ; } if ( proxyUser == null && sessionConf != null && sessionConf . containsKey ( HiveAuthFactory . HS2_PROXY_USER ) ) { String proxyUserFromThriftBody = sessionConf . get ( HiveAuthFactory . HS2_PROXY_USER ) ; LOG . debug ( "Proxy user from thrift body: " + proxyUserFromThriftBody ) ; proxyUser = proxyUserFromThriftBody ; } if ( proxyUser == null ) { return realUser ; } // check whether substitution is allowed if ( ! hiveConf . getBoolVar ( HiveConf . ConfVars . HIVE_SERVER2_ALLOW_USER_SUBSTITUTION ) ) { throw new HiveSQLException ( "Proxy user substitution is not allowed" ) ; } // If there's no authentication, then directly substitute the user if ( HiveAuthFactory . AuthTypes . NONE . toString ( ) . equalsIgnoreCase ( hiveConf . getVar ( ConfVars . HIVE_SERVER2_AUTHENTICATION ) ) ) { return proxyUser ; } // Verify proxy user privilege of the realUser for the proxyUser HiveAuthFactory . verifyProxyAccess ( realUser , proxyUser , ipAddress , hiveConf ) ; LOG . debug ( "Verified proxy user: " + proxyUser ) ; return proxyUser ; }
If the proxy user name is provided then check privileges to substitute the user .