gaurav1086 3781132ef6 IMPALA-13675: OAuth AuthN Support for Impala Shell ...

This patch adds the support to fetch access tokens
from the OAuth Server using the OAuth client_id and
client_secret if the access token is not provided.
It covers the flow: client_credentials.
The client_secret can either be passed as a file or
be prompted to enter.

Added a test param for impala shell oauth_mock_response_cmd
to mock oauth server response only to be used for testing.
Also suppressed existing option hs2_x_forward from the
impala --help output.

Testing(okta oauth server):
- Added custom_cluster tests in test_shell_jwt_auth.py:
    test_oauth_auth_with_clientid_and_secret_success
    test_oauth_auth_with_clientid_and_secret_failure
- Tested manually by providing --user <user> and
  --oauth_client_secret_cmd="cat password_file.txt"
- Tested manually by providing --user <user> and no
  --oauth_client_secret_cmd, thereby prompting the user
  to enter the client_secret.

Example command: impala-shell.sh -a
--auth_creds_ok_in_clear --protocol="hs2-http"
--oauth_client_id="client_id"
--oauth_client_secret_cmd="cat client_secret.txt"
--oauth_server="dev.us.auth01.com"
--oauth_endpoint="/oauth/token"

Change-Id: I84e26d54f6a53696660728efb239ffd43de4c55d
Reviewed-on: http://gerrit.cloudera.org:8080/22424
Reviewed-by: Impala Public Jenkins <impala-public-jenkins@cloudera.com>
Tested-by: Impala Public Jenkins <impala-public-jenkins@cloudera.com>

2025-06-05 21:15:47 +00:00

14 KiB

Raw Permalink Blame History

View Raw