Lack of $ENV{USER} leading to the weird authentication error

[burak]

Compare this

$ perl -MThrift::API::HiveClient2 -wE ' Thrift::API::HiveClient2->new(qw/ host hiveserver2-host port 10000 timeout 7200 username hive /, sasl => { mechanism => "PLAIN", callback => {qw/ pass none canonuser hive /} } )->execute("select 1 + 1"); say 42 ' 42

with this

$ perl -MThrift::API::HiveClient2 -wE ' delete $ENV{USER}; Thrift::API::HiveClient2->new(qw/ host hiveserver2-host port 10000 timeout 7200 username hive /, sasl => { mechanism => "PLAIN", callback => {qw/ pass none canonuser hive /} } )->execute("select 1 + 1"); say 42 ' Authentication failed: 3 > Error validating the login at Thrift/SASL/Transport.pm line 114.

Not sure about the actual culprit yet.

[dmorel]

I suspect this could lead you deep in cyrus-sasl which is the underlying library Le jeu. 9 mars 2017 à 19:29, Burak Gürsoy <notifications@github.com> a écrit :

…

Compare this ` $ perl -MThrift::API::HiveClient2 -wE ' Thrift::API::HiveClient2->new(qw/ host hiveserver2-host port 10000 timeout 7200 username hive /, sasl => { mechanism => "PLAIN", callback => {qw/ pass none canonuser hive /} } )->execute("select 1 + 1"); say 42 ' 42 ` with this ` $ perl -MThrift::API::HiveClient2 -wE ' delete $ENV{USER}; Thrift::API::HiveClient2->new(qw/ host hiveserver2-host port 10000 timeout 7200 username hive /, sasl => { mechanism => "PLAIN", callback => {qw/ pass none canonuser hive /} } )->execute("select 1 + 1"); say 42 ' Authentication failed: 3 > Error validating the login at Thrift/SASL/Transport.pm line 114. ` Not sure about the actual culprit yet. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#1>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AADVnJfd5j5Eo4cmyFpRtdDF5IzyKWgVks5rkEUjgaJpZM4MYdbi> .

[burak]

Thanks. Yes, that might be. I didn't dig deeper yet. But the error is not triggered if the value is empty or undef or USER=whateverfakevalue and only happens when it's absent all together.

[burak]

@dmorel a quick check on the source seems to show that you are correct ;)

https://github.com/dinhviethoa/cyrus-sasl/blob/master/lib/common.c#L1536

1534 switch(id) {
1535 case SASL_CB_AUTHNAME:
1536 userid = getenv("USER");
1537 if (userid != NULL) {
1538 *result = userid;
1539 if (len) *len = strlen(userid);
1540 return SASL_OK;
1541 }
1542 userid = getenv("USERNAME");
1543 if (userid != NULL) {
1544 *result = userid;
1545 if (len) *len = strlen(userid);
1546 return SASL_OK;
1547 }
...
1564 return SASL_FAIL;
1565 default:
1566 return SASL_BADPARAM;
1567 }
1568 }

Damn, I hate this GitHub crappy formatting

[burak]

@dmorel OTOH if $ENV{USER} is used like this then what are we authenticating against when setting the username option I wonder ;p (still have to read the code to figure out how these things work together though)

[burak]

Pushed 8c5169d to have a verbose message for the issue

[burak]

Detecting and warning should be enough. The upstream XS module or the C code should ideally be fixed but they seem to be dead^Wstable code so I'm not holding my breath.