CODEWITHSUNDEEP
hadoophivekerberosclouderahadoop-yarn
Atom
Atom

Reputation: 788

connect to hive in a secured kerberos authenticated cluster using keytab

I am using CDH 5.3.3 and using hive JDBC driver to connect to hive in the secured cluster. I tried to login using keytab using

UserGroupInformation.loginUserFromKeytab(lprincipal, keytabpath);

I have used the following format for hive url.

jdbc:hive2://localhost:10000;AuthMech=1;KrbRealm=EXAMPLE.COM; KrbHostFQDN=hs2.example.com;KrbServiceName=hive

Sample code :

// Authenticating Kerberos principal
System.out.println("Principal Authentication: ");
final String user = "[email protected]";
final String keyPath = "cloudera.keytab";
UserGroupInformation.loginUserFromKeytab(user, keyPath);
Connection connection = DriverManager.getConnection(url);

Url is in the following format:

jdbc:hive2://localhost:10000;AuthMech=1;KrbRealm=EXAMPLE.COM; KrbHostFQDN=hs2.example.com;KrbServiceName=hive

I get the following exception, I would appreciate if some help is provided in identifying the cause of this issue: 

com.cloudera.hive.support.exceptions.GeneralException: CONN_KERBEROS_AUTHENTICATION_ERROR_GET_TICKETCACHE

javax.security.auth.login.LoginException: Unable to obtain Princpal Name for authentication
at com.sun.security.auth.module.Krb5LoginModule.promptForName(Krb5LoginModule.java:800)
at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:671)
at com.sun.security.auth.module.Krb5LoginModule.login(Krb5LoginModule.java:584)
at sun.reflect.NativeMethodAccessorImpl.inv

FOr a differn distribution of cluster, after adding debug, I see the following exception :

DEBUG org.apache.hadoop.security.UserGroupInformation: hadoop login
DEBUG org.apache.hadoop.security.UserGroupInformation: hadoop login commit
DEBUG org.apache.hadoop.security.UserGroupInformation: using kerberos            user:null
DEBUG org.apache.hadoop.security.UserGroupInformation: using local user:UnixPrincipal: user66
DEBUG org.apache.hadoop.security.UserGroupInformation: UGI loginUser:user66 (auth:KERBEROS)
DEBUG org.apache.hadoop.security.UserGroupInformation: PrivilegedAction as:user66 (auth:KERBEROS) from:org.apache.hadoop.hive.thrift.client.TUGIAssumingTransport.open(TUGIAssumingTransport.java:49)
DEBUG org.apache.thrift.transport.TSaslTransport: opening transport org.apache.thrift.transport.TSaslClientTransport@1f20a0ab
ERROR org.apache.thrift.transport.TSaslTransport: SASL negotiation failure
javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException:   No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)]
    at   com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:212)
     at org.apache.thrift.transport.TSaslClientTransport.handleSaslStartMessage(TSaslClientTransport.java:94)
    at org.apache.thrift.transport.TSaslTransport.open(TSaslTransport.java:253)
    at org.apache.thrift.transport.TSaslClientTransport.open(TSaslClientTransport.java:37)
    at org.apache.hadoop.hive.thrift.client.TUGIAssumingTransport$1.run(TUGIAssumingTransport.java:52)
    at org.apache.hadoop.hive.thrift.client.TUGIAssumingTransport$1.run(TUGIAssumingTransport.java:49)
    at java.security.AccessController.doPrivileged(Native Method)
    at javax.security.auth.Subject.doAs(Subject.java:415)
    at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1548)
    at org.apache.hadoop.hive.thrift.client.TUGIAssumingTransport.open(TUGIAssumingTransport.java:49)
    at org.apache.hive.jdbc.HiveConnection.openTransport(HiveConnection.java:156)
    at org.apache.hive.jdbc.HiveConnection.<init>(HiveConnection.java:96)
    at org.apache.hive.jdbc.HiveDriver.connect(HiveDriver.java:104)

Upvotes: 2

Views: 10187

Answers (3)

Dinesh
Dinesh

Reputation: 124

This link will help you to connect kerberos enabled(kerberised) hive cluster using keytab.

Since you already have a keytab file in place, you additionally need JAAS Config file, Java Subjects abstraction and Java CallbackHandler for a successfull connection. And of course, dependent libraries (jar files) are required.

HTH.

Upvotes: 1

Tagar
Tagar

Reputation: 14891

http://appcrawler.com/wordpress/2015/06/18/examples-of-connecting-to-kerberos-hive-in-jdbc/

have some working examples for JDBC connection to a kerberized Hive.

Good advice from @Samson Scharfrichter on debugging. +1'd

javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)] at com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:212) at org.apache.thrift.transport.TSaslClientTransport.handleSaslStartMessage(TSaslClientTransport.java:94)

"GSS initiate failed" + "GSSException: No valid credentials provided" normally means your client-side kerberos ticket does not exist or has expired.

Please run klist on client side and copy-paste it here.

Upvotes: 0

Samson Scharfrichter
Samson Scharfrichter

Reputation: 9067

Beware, mortal: Kerberos is just black magic. It will suck your soul away. Seriously.

Now, there is very poorly documented way to activate the GSSAPI trace, that is your only hope of zooming on the actual issue (probably a cryptic syntax error in a config file that GSS silently discards by default)

-Djava.security.debug=gssloginconfig,configfile,configparser,logincontext

The original book of spells is there.

Upvotes: 10

Related Questions