Skip to content

[Fix](Hdfs)Fix Kerberos auth config detection and auto-enable hive.metastore.sasl #59748

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
CalvinKirs merged 1 commit into from
Jan 12, 2026
Merged

[Fix](Hdfs)Fix Kerberos auth config detection and auto-enable hive.metastore.sasl #59748

CalvinKirs merged 1 commit into from
Jan 12, 2026

Conversation

@CalvinKirs
Copy link
Member

@CalvinKirs CalvinKirs commented Jan 12, 2026

What problem does this PR solve?

  1. Fix an issue where hdfs.authentication.type cannot reliably detect Kerberos authentication. As a temporary workaround, use hadoop.security.authentication for Kerberos detection.

  2. Automatically set hive.metastore.sasl.enabled=true when HMS Kerberos authentication is enabled to ensure proper SASL/GSSAPI handshake.

Release note

None

Check List (For Author)

  • Test

    • Regression test
    • Unit Test
    • Manual test (add detailed scripts or steps below)
    • No need to test or manual test. Explain why:
      • This is a refactor/code format and no logic has been changed.
      • Previous test can cover this change.
      • No code files have been changed.
      • Other reason

  • Behavior changed:

    • No.
    • Yes.

  • Does this need documentation?

    • No.
    • Yes.

Check List (For Reviewer who merge this PR)

  • Confirm the release note
  • Confirm test cases
  • Confirm document
  • Add branch pick label

@CalvinKirs
[Fix](Hdfs)Fix Kerberos auth config detection and auto-enable hive.me…
b03210b 
…tastore.sasl

1. Fix an issue where `hdfs.authentication.type` cannot reliably detect Kerberos authentication.
   As a temporary workaround, use `hadoop.security.authentication` for Kerberos detection.

2. Automatically set `hive.metastore.sasl.enabled=true` when HMS Kerberos authentication is enabled
   to ensure proper SASL/GSSAPI handshake.
@hello-stephen
Copy link
Contributor

hello-stephen commented Jan 12, 2026

Thank you for your contribution to Apache Doris.
Don't know what should be done next? See How to process your PR.

Please clearly describe your PR:

  1. What problem was fixed (it's best to include specific error reporting information). How it was fixed.
  2. Which behaviors were modified. What was the previous behavior, what is it now, why was it modified, and what possible impacts might there be.
  3. What features were added. Why was this function added?
  4. Which code was refactored and why was this part of the code refactored?
  5. Which functions were optimized and what is the difference before and after the optimization?

@CalvinKirs
Copy link
Member Author

CalvinKirs commented Jan 12, 2026

run buildall

@github-actions github-actions bot added the approved Indicates a PR has been approved by one committer. label Jan 12, 2026
@github-actions
Copy link
Contributor

github-actions bot commented Jan 12, 2026

PR approved by at least one committer and no changes requested.

@github-actions
Copy link
Contributor

github-actions bot commented Jan 12, 2026

PR approved by anyone and no changes requested.

@CalvinKirs
Copy link
Member Author

CalvinKirs commented Jan 12, 2026

run feut

@doris-robot
Copy link

doris-robot commented Jan 12, 2026

TPC-H: Total hot run time: 31980 ms 
machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/tpch-tools
Tpch sf100 test result on commit b03210b390299aa4449bb90c34e23264752785c1, data reload: false

------ Round 1 ----------------------------------
q1	17663	4227	4121	4121
q2	2034	370	243	243
q3	10149	1299	721	721
q4	10205	825	315	315
q5	7520	2174	1844	1844
q6	193	173	140	140
q7	942	810	677	677
q8	9265	1383	1133	1133
q9	5002	4600	4717	4600
q10	6833	1818	1395	1395
q11	546	291	295	291
q12	772	733	580	580
q13	17767	3850	3076	3076
q14	286	314	291	291
q15	601	536	515	515
q16	704	685	632	632
q17	697	850	467	467
q18	6802	6324	7139	6324
q19	1115	1025	654	654
q20	411	362	256	256
q21	3316	2677	2678	2677
q22	1140	1052	1028	1028
Total cold run time: 103963 ms
Total hot run time: 31980 ms

----- Round 2, with runtime_filter_mode=off -----
q1	4514	4301	4327	4301
q2	319	393	310	310
q3	2225	2774	2398	2398
q4	1430	1950	1506	1506
q5	4383	4381	4373	4373
q6	219	174	127	127
q7	2209	1858	1761	1761
q8	2517	2416	2570	2416
q9	7126	7187	7147	7147
q10	2581	2705	2399	2399
q11	571	466	495	466
q12	732	746	658	658
q13	3637	4079	3350	3350
q14	283	293	261	261
q15	529	490	479	479
q16	619	648	612	612
q17	1107	1290	1309	1290
q18	7548	7329	7105	7105
q19	840	790	777	777
q20	1893	1993	1843	1843
q21	4569	4372	4094	4094
q22	1049	999	975	975
Total cold run time: 50900 ms
Total hot run time: 48648 ms

@doris-robot
Copy link

doris-robot commented Jan 12, 2026

TPC-DS: Total hot run time: 174254 ms 
machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/tpcds-tools
TPC-DS sf100 test result on commit b03210b390299aa4449bb90c34e23264752785c1, data reload: false

query5	5119	591	438	438
query6	330	222	220	220
query7	4229	450	269	269
query8	314	238	232	232
query9	8769	2655	2636	2636
query10	531	384	319	319
query11	15434	15242	14824	14824
query12	195	118	117	117
query13	1255	507	362	362
query14	6855	3017	2820	2820
query14_1	2678	2658	2727	2658
query15	198	194	178	178
query16	1007	477	471	471
query17	1071	694	582	582
query18	2708	452	355	355
query19	234	227	195	195
query20	128	118	118	118
query21	221	140	124	124
query22	3882	3947	3904	3904
query23	16184	15542	15629	15542
query23_1	15485	15424	15620	15424
query24	7279	1574	1179	1179
query24_1	1196	1197	1209	1197
query25	567	489	441	441
query26	1250	279	163	163
query27	2738	461	295	295
query28	4472	2145	2135	2135
query29	830	589	474	474
query30	316	240	217	217
query31	756	632	558	558
query32	76	72	65	65
query33	547	345	303	303
query34	937	871	544	544
query35	737	768	675	675
query36	887	859	853	853
query37	154	93	78	78
query38	2739	2656	2671	2656
query39	767	757	738	738
query39_1	707	730	688	688
query40	214	131	113	113
query41	65	62	67	62
query42	107	103	105	103
query43	479	485	421	421
query44	1337	730	755	730
query45	187	185	178	178
query46	849	951	591	591
query47	1419	1468	1385	1385
query48	311	331	238	238
query49	615	411	321	321
query50	645	273	203	203
query51	3832	3773	3771	3771
query52	104	113	98	98
query53	295	328	275	275
query54	283	253	253	253
query55	76	74	72	72
query56	295	287	303	287
query57	1042	1042	953	953
query58	270	256	253	253
query59	2048	2142	2177	2142
query60	320	325	299	299
query61	164	154	162	154
query62	391	358	318	318
query63	307	276	276	276
query64	4960	1294	1028	1028
query65	3837	3723	3776	3723
query66	1361	412	307	307
query67	15588	15616	15583	15583
query68	5855	1000	703	703
query69	519	353	317	317
query70	1063	922	958	922
query71	372	305	275	275
query72	5848	3534	3462	3462
query73	786	723	298	298
query74	8816	8762	8579	8579
query75	2857	2799	2422	2422
query76	3419	1055	658	658
query77	521	373	285	285
query78	9837	9901	9035	9035
query79	1025	931	601	601
query80	1536	559	484	484
query81	548	262	233	233
query82	414	148	116	116
query83	366	257	236	236
query84	258	121	104	104
query85	916	521	471	471
query86	402	321	291	291
query87	2878	2897	2740	2740
query88	3240	2243	2220	2220
query89	401	343	336	336
query90	1913	165	156	156
query91	184	164	147	147
query92	74	71	62	62
query93	1072	930	535	535
query94	632	320	296	296
query95	566	332	352	332
query96	593	475	203	203
query97	2335	2378	2338	2338
query98	231	203	206	203
query99	580	578	512	512
Total cold run time: 254301 ms
Total hot run time: 174254 ms

@hello-stephen
Copy link
Contributor

hello-stephen commented Jan 12, 2026

FE UT Coverage Report

Increment line coverage 100.00% (2/2) 🎉
Increment coverage report
Complete coverage report

@CalvinKirs
Copy link
Member Author

CalvinKirs commented Jan 12, 2026

run cloud_p0

@CalvinKirs CalvinKirs merged commit 3e29642 into apache:master Jan 12, 2026
30 of 31 checks passed
github-actions bot pushed a commit that referenced this pull request Jan 12, 2026
@CalvinKirs
[Fix](Hdfs)Fix Kerberos auth config detection and auto-enable hive.me…
214f803 
…tastore.sasl (#59748)

### What problem does this PR solve?

1. Fix an issue where `hdfs.authentication.type` cannot reliably detect
Kerberos authentication. As a temporary workaround, use
`hadoop.security.authentication` for Kerberos detection.

2. Automatically set `hive.metastore.sasl.enabled=true` when HMS
Kerberos authentication is enabled to ensure proper SASL/GSSAPI
handshake.

### Release note

None
@github-actions github-actions bot mentioned this pull request Jan 12, 2026
Closed
github-actions bot pushed a commit that referenced this pull request Jan 12, 2026
@CalvinKirs
[Fix](Hdfs)Fix Kerberos auth config detection and auto-enable hive.me…
7869aa5 
…tastore.sasl (#59748)

### What problem does this PR solve?

1. Fix an issue where `hdfs.authentication.type` cannot reliably detect
Kerberos authentication. As a temporary workaround, use
`hadoop.security.authentication` for Kerberos detection.

2. Automatically set `hive.metastore.sasl.enabled=true` when HMS
Kerberos authentication is enabled to ensure proper SASL/GSSAPI
handshake.

### Release note

None
@github-actions github-actions bot mentioned this pull request Jan 12, 2026
Merged
yiguolei pushed a commit that referenced this pull request Jan 13, 2026
@github-actions @CalvinKirs
branch-4.0: [Fix](Hdfs)Fix Kerberos auth config detection and auto-en…
b4d26a3 
…able hive.metastore.sasl #59748 (#59763)

Cherry-picked from #59748

---------

Co-authored-by: Calvin Kirs <guoqiang@selectdb.com>
zzzxl1993 pushed a commit to zzzxl1993/doris that referenced this pull request Jan 13, 2026
@CalvinKirs @zzzxl1993
[Fix](Hdfs)Fix Kerberos auth config detection and auto-enable hive.me…
7a395fb 
…tastore.sasl (apache#59748)

### What problem does this PR solve?

1. Fix an issue where `hdfs.authentication.type` cannot reliably detect
Kerberos authentication. As a temporary workaround, use
`hadoop.security.authentication` for Kerberos detection.

2. Automatically set `hive.metastore.sasl.enabled=true` when HMS
Kerberos authentication is enabled to ensure proper SASL/GSSAPI
handshake.

### Release note

None
@yiguolei yiguolei mentioned this pull request Jan 23, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@morningman morningman morningman approved these changes

+1 more reviewer

@hubgeter hubgeter hubgeter approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

approved Indicates a PR has been approved by one committer. dev/3.1.x dev/4.0.3-merged reviewed

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@CalvinKirs @hello-stephen @doris-robot @morningman @hubgeter @yiguolei