Using Kerberos Constrained Delegation

The connector can also be configured to use Kerberos Constrained Delegation. This feature allows a service to obtain service tickets to a restricted list of other services running on specific servers on the network after it has been presented with a service ticket. For more details on the process see: https://technet.microsoft.com/en-ca/library/cc995228.aspx.

The userGSSCredential connection property can be used in the connection URL to pass in a GSSCredential object. The following sample code shows how to use the property to pass the GSSCredential into the connector using JDBC 4.1.

GSSCredential userCredential = [GSSCredential]

Driver driver = (Driver) Class.forName("com.simba.impala.jdbc.Driver").newInstance();

Properties properties = new Properties();

properties.put("userGSSCredential", userCredential);

Connection conn = driver.connect(

"jdbc:impala://node1.example.com:21050;AuthMech=1;KrbRealm=EXAMPLE.COM;

KrbHostFQDN=node1.example.com;KrbServiceName=impala" ,properties);