Support Secure Impersonation for DataStage Big Integrate JDBC Hive connection

We are using the JAAS configuration file (JDBCDriverLogin.conf) to implement the Kerberos authentication mechanism. In our original beta testing with PX on Hadoop , we found that DataStage assumed that the Hive SPN and cache would be used for authentication. Since this is not the case at Aetna, we implemented the following solution.

Configured the DataStage admin ID/cache to form the JDBC connection to Hive. This worked great during our infrastructure testing when running as the DataStage admin ID, but now that we are running with multiple users, we realize that the DataStage admin will need to be added to all of the various groups the applications will want to access and is not a workable solution .

Our JAAS Configuration is as follows:
JDBC_DRIVER_01 {
com.ibm.security.auth.module.Krb5LoginModule required
credsType=both
principal="S032593@AETH.AETNA.COM"
useKeytab="FILE:/InformationServer/Server/DSEngine/JDBCcache/BIJDBC.keytab"
debug=true;
};

Rather than granting the DS Admin ID access to all the various application groups (which will be sizable), our Hadoop engineering team suggested using secure impersonation to allow the service to act as the logged in user to access data.

Our hadoop engineering team provided the following info. The first 2 links give context, and the last one is probably most relevant to this situation.

https://hadoop.apache.org/docs/r1.2.1/Secure_Impersonation.html

https://hadoop.apache.org/docs/stable/hadoop-project-dist/hadoop-common/Superusers.html

https://cwiki.apache.org/confluence/display/Hive/HiveServer2+Clients#HiveServer2Clients-Multi-UserScenariosandProgrammaticLogintoKerberosKDC


In the meantime, we have implemented the usage of multiple stanzas to the JAAS configuration for each user. This is a manual and potentially error prone process as users would need to be added and removed. We can implement this solution for the short term, but request secure impersonation support as the strategic solution as we prepare to implement and significantly scale up usage of Big Integrate here at Aetna.