Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Kerberos auth (http client) #1541

Open
wants to merge 10 commits into
base: main
Choose a base branch
from

Conversation

maciejmaciejko-gid
Copy link

@maciejmaciejko-gid maciejmaciejko-gid commented Jan 31, 2024

Summary

Supporting kerberos auth in HTTP client.

Checklist

Delete items not relevant to your PR:

  • Unit and integration tests covering the common scenarios were added
  • A human-readable description of the changes was provided to include in CHANGELOG
  • For significant changes, documentation in https://github.com/ClickHouse/clickhouse-docs was updated with further explanations or tutorials

@CLAassistant
Copy link

CLAassistant commented Jan 31, 2024

CLA assistant check
All committers have signed the CLA.

@mzitnik
Copy link
Contributor

mzitnik commented Feb 4, 2024

@maciejmaciejko-gid
It's failing. Did you run it locally before?

[INFO] ------------------------------------------------------------------------
Error:  Failed to execute goal org.apache.maven.plugins:maven-compiler-plugin:3.11.0:testCompile (default-testCompile) on project clickhouse-http-client: Compilation failure
Error:  /home/runner/work/clickhouse-java/clickhouse-java/clickhouse-http-client/src/test/java/com/clickhouse/client/http/ClickHouseHttpConnectionTest.java:[3,26] cannot access org.mockito.Mockito
Error:    bad class file: /home/runner/.m2/repository/org/mockito/mockito-core/5.9.0/mockito-core-5.9.0.jar(org/mockito/Mockito.class)
Error:      class file has wrong version 55.0, should be 52.0
Error:      Please remove or make sure it appears in the correct subdirectory of the classpath.
Error:  -> [Help 1]

@mzitnik
Copy link
Contributor

mzitnik commented Feb 4, 2024

Can we also run a full integration test for Kerberos?

@maciejmaciejko-gid
Copy link
Author

@mzitnik
I'm sorry, I used higher java version, therefore I was able to use latest mockito which is built in java11.
Issue fixed. Integration test added. I also optimized handling credentials.
The most tricky part with kerberos is configuration (a lot of options, moreover it's possible to use jgss native lib, what makes things even more complicated).
That implementation handles two ways of acquiring credentials - directly from host or passed via subject. That way it's possible to handle e.g. impersonation and passing TGT.
The implementation was tested with Tableau Server (as kerberos delegation/impersonation) and on Tableau Desktop with AD.

@mzitnik
Copy link
Contributor

mzitnik commented Feb 11, 2024

Thanks @maciejmaciejko-gid running tests

@maciejmaciejko-gid
Copy link
Author

Oh, I used cached image... Give me a moment, I will fix it

@maciejmaciejko-gid
Copy link
Author

@mzitnik
Could you run pipeline again?

@maciejmaciejko-gid
Copy link
Author

Sorry, error with sample. It would be easier if I could try pipeline before code review... fixed

@mzitnik
Copy link
Contributor

mzitnik commented Feb 11, 2024

@maciejmaciejko-gid did you run it locally

@maciejmaciejko-gid
Copy link
Author

@mzitnik
I misunderstand the purpose of examples. Sample removed. I'm going to describe that feature in clickhouse-docs and back to you with this PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants