Apache Drill 模拟

Question

我正在尝试在我们的 Drill (1.6.0) 系统上构建安全性。我设法让安全用户身份验证工作(如文档中所述的 JPam)，但模拟似乎不起作用。它似乎通过管理员用户执行和获取，而不管谁通过 ODBC 登录。

我的drill-override.conf文件配置如下:

  drill.exec: {
  cluster-id: "drillbits1",
  zk.connect: "localhost:2181",
  impersonation: {
    enabled: true,
    max_chained_user_hops: 3
  },
  security.user.auth {
      enabled: true,
      packages += "org.apache.drill.exec.rpc.user.security",
      impl: "pam",
      pam_profiles: [ "sudo", "login" ]  
  }
}

我们也只在一台服务器上使用 Drill，因此我正在运行 drill-embedded 来启动它。故障排除:

root@srv001:/opt/apache-drill-1.6.0# bin/sqlline -u "jdbc:drill:schema=dfs;zk=localhost:2181;impersonation_target=dUser001" -n entryUser -p entryUserPassword
        Error: Failure in connecting to Drill: org.apache.drill.exec.rpc.RpcException: Failure setting up ZK for client.  (state=,code=0)
       java.sql.SQLException: Failure in connecting to Drill:  org.apache.drill.exec.rpc.RpcException: Failure setting up ZK for client.
        at org.apache.drill.jdbc.impl.DrillConnectionImpl.<init> (DrillConnectionImpl.java:159)
        at org.apache.drill.jdbc.impl.DrillJdbc41Factory.newDrillConnection(DrillJdbc41Factory.java:64)
        at org.apache.drill.jdbc.impl.DrillFactory.newConnection(DrillFactory.java:69)
        at net.hydromatic.avatica.UnregisteredDriver.connect(UnregisteredDriver.java:126)
        at org.apache.drill.jdbc.Driver.connect(Driver.java:72)
        at sqlline.DatabaseConnection.connect(DatabaseConnection.java:167)
        at sqlline.DatabaseConnection.getConnection(DatabaseConnection.java:213)
        at sqlline.Commands.connect(Commands.java:1083)
        at sqlline.Commands.connect(Commands.java:1015)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:606)
        at sqlline.ReflectiveCommandHandler.execute(ReflectiveCommandHandler.java:36)
        at sqlline.SqlLine.dispatch(SqlLine.java:742)
        at sqlline.SqlLine.initArgs(SqlLine.java:528)
        at sqlline.SqlLine.begin(SqlLine.java:596)
        at sqlline.SqlLine.start(SqlLine.java:375)
        at sqlline.SqlLine.main(SqlLine.java:268)
        Caused by: org.apache.drill.exec.rpc.RpcException: Failure setting up ZK for client.
        at org.apache.drill.exec.client.DrillClient.connect(DrillClient.java:200)
        at org.apache.drill.jdbc.impl.DrillConnectionImpl.<init>(DrillConnectionImpl.java:151)
        ... 18 more
    Caused by: java.io.IOException: Failure to connect to the zookeeper cluster service within the allotted time of 10000 milliseconds.
        at org.apache.drill.exec.coord.zk.ZKClusterCoordinator.start(ZKClusterCoordinator.java:123)
        at org.apache.drill.exec.client.DrillClient.connect(DrillClient.java:198)
        ... 19 more

对此有什么想法吗？

我也考虑过做我自己的内置安全，但我无法从 SQL 查询中检索用户名。我尝试了以下但没有任何运气:

CURRENT_USER()  
USER()   
SESSION_USER()   

对这种方法有什么想法吗？

Answer 1

我建议创建一个不同的 pam 配置文件(比如 drill)而不是登录和 sudo。然后在/etc/pam.d/目录下创建 drill 文件，内容为:

#%PAM-1.0
auth include password-auth
account include password-auth

要运行连接:

select * from sys.connections;