Skip to content

ConnectionContext prompts for credentials with X.509 certificate authentication #41

Description

@AdeshShambhu

Component: hana-ml Python library

Issue: When using X.509 certificate authentication for Hana Cloud, ConnectionContext incorrectly prompts for username/password interactively, causing execution to hang.

Expected Behavior: ConnectionContext should accept X.509 authentication parameters (authenticationMethods='X509', authenticationX509=) and create a connection without prompting for credentials, similar to how hdbcli.dbapi.connect() works.

Actual Behavior: Even when X.509 parameters are provided, ConnectionContext.init() triggers getpass.getpass() prompting for password interactively. In non-interactive environments, this causes the application to hang indefinitely.
The check doesn't account for X.509 authentication (passed via **properties), so when password=None and no userkey is provided, it still prompts even though X.509 credentials are present.

Reproduction:

from hana_ml.dataframe import ConnectionContext
                                                                                                                                                                   
 conn = ConnectionContext(                                                                                                                                         
     address='<hana-host>',                                                                                                                                        
     port=443,                                                                                                                                                     
     encrypt=True,                                                                                                                                                 
     sslCryptoProvider='openssl',
     authenticationMethods='X509',                                                                                                                                 
     authenticationX509='<certificate-pem-string>',                                                                                                                    
     currentSchema='MY_SCHEMA'                                                                                                                                     
 ) 

==> Hangs waiting for user/namepassword input

Workaround:
Pass user='' and password='' (empty strings, not None) to bypass the prompt:

conn = ConnectionContext(                                                                                                                                         
      address='<hana-host>',                                                                                                                                        
      port=443,                                                                                                                                                     
      user='',  # Empty string prevents prompt
      password='',  # Empty string prevents prompt                                                                                                                  
      encrypt=True,                                                                                                                                                 
      sslCryptoProvider='openssl',                                                                                                                                  
      authenticationMethods='X509',                                                                                                                                 
      authenticationX509='<certificate-string>',                                                                                                                    
      currentSchema='MY_SCHEMA'                                                                                                                                     
  )  

Impact:

  • Breaks X.509 authentication in non-interactive environments
  • Affects Cloud Foundry deployments, Kubernetes jobs, CI/CD pipelines
  • Forces users to use workarounds or avoid ConnectionContext entirely

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions