@Rocky when create external catalog, how to create access Paimon Privileged Catalogs? Now, it use anonymous user to access

To create a Paimon catalog with privileged access and avoid using the "anonymous" user, you need to configure the user identity and enable the "Privileged Catalog" feature in the catalog properties. In Apache Paimon, a Privileged Catalog is one that can handle user privileges (often used for integration with security systems like Apache Ranger). To configure this in StarRocks, follow these steps: 1. Enable Privileged Metastore When creating the Paimon catalog, you can pass the Paimon-specific property

metastore.privileged

in the

PROPERTIES

block. This tells Paimon to use the provided user identity for metastore operations.

sql
CREATE EXTERNAL CATALOG paimon_catalog
PROPERTIES
(
    "type" = "paimon",
    "paimon.catalog.type" = "hive", -- or "filesystem"
    "paimon.catalog.warehouse" = "hdfs://<namenode_ip>:9000/path/to/paimon",
    "hive.metastore.uris" = "thrift://<metastore_ip>:9083",
    "metastore.privileged" = "true"  -- Enables Privileged Catalog feature
);

2. Set the Access User If your cluster is accessing HDFS or Hive Metastore and defaulting to "anonymous", you have two primary ways to specify the user: Method A: Per-Catalog User (Recommended) In recent StarRocks versions, you can often specify the

username

property directly in the catalog creation statement to impersonate a specific user for that catalog:

sql
CREATE EXTERNAL CATALOG paimon_catalog
PROPERTIES
(
    "type" = "paimon",
    "paimon.catalog.type" = "hive",
    "paimon.catalog.warehouse" = "hdfs://...",
    "hive.metastore.uris" = "thrift://...",
    "username" = "your_privileged_user", -- Specify the user here
    "metastore.privileged" = "true"
);

Method B: Global Hadoop User (Environment Variable) By default, StarRocks uses the username of the FE/BE process. If you want to set a global user for all HDFS/Hive interactions across the cluster, you can set the

HADOOP_USER_NAME

environment variable: 1. Open

fe/conf/hadoop_env.sh

on all FE nodes and

be/conf/hadoop_env.sh

on all BE nodes. 2. Add the following line at the beginning:

bash
    export HADOOP_USER_NAME="your_privileged_user"

3. Restart the FE and BE processes. 3. Kerberos Authentication (If applicable) If your Paimon catalog (Hive or HDFS) is secured with Kerberos, the "anonymous" access usually happens when a valid ticket is missing. You must: 1. Run

kinit

on all FE/BE nodes to obtain a ticket. 2. Add the Kerberos configuration to

fe.conf

and `be.conf`:

properties
    JAVA_OPTS="-Djava.security.krb5.conf=/etc/krb5.conf"

Summary of Properties Property | Value | Description

metastore.privileged

|

true

| Enables the Paimon Privileged Catalog feature.

username

|

String

| Specifies the user identity for this specific catalog.

paimon.catalog.type

|

hive

/

filesystem

| The metastore type for Paimon. References • data_source/catalog/paimon_catalog.md