connect to hive in a secured kerberos authenticated cluster using keytab

问题:

I am using CDH 5.3.3 and using hive JDBC driver to connect to hive in the secured cluster. I tried to login using keytab using

UserGroupInformation.loginUserFromKeytab(lprincipal, keytabpath);

I have used the following format for hive url.

jdbc:hive2://localhost:10000;AuthMech=1;KrbRealm=EXAMPLE.COM; KrbHostFQDN=hs2.example.com;KrbServiceName=hive

Sample code :

// Authenticating Kerberos principal System.out.println("Principal Authentication: "); final String user = "cloudera@CLOUDERA.COM"; final String keyPath = "cloudera.keytab"; UserGroupInformation.loginUserFromKeytab(user, keyPath); Connection connection = DriverManager.getConnection(url);

Url is in the following format:

jdbc:hive2://localhost:10000;AuthMech=1;KrbRealm=EXAMPLE.COM; KrbHostFQDN=hs2.example.com;KrbServiceName=hive

I get the following exception, I would appreciate if some help is provided in identifying the cause of this issue:

com.cloudera.hive.support.exceptions.GeneralException: CONN_KERBEROS_AUTHENTICATION_ERROR_GET_TICKETCACHE  javax.security.auth.login.LoginException: Unable to obtain Princpal Name for authentication at com.sun.security.auth.module.Krb5LoginModule.promptForName(Krb5LoginModule.java:800) at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:671) at com.sun.security.auth.module.Krb5LoginModule.login(Krb5LoginModule.java:584) at sun.reflect.NativeMethodAccessorImpl.inv

FOr a differn distribution of cluster, after adding debug, I see the following exception :

DEBUG org.apache.hadoop.security.UserGroupInformation: hadoop login DEBUG org.apache.hadoop.security.UserGroupInformation: hadoop login commit DEBUG org.apache.hadoop.security.UserGroupInformation: using kerberos            user:null DEBUG org.apache.hadoop.security.UserGroupInformation: using local user:UnixPrincipal: user66 DEBUG org.apache.hadoop.security.UserGroupInformation: UGI loginUser:user66 (auth:KERBEROS) DEBUG org.apache.hadoop.security.UserGroupInformation: PrivilegedAction as:user66 (auth:KERBEROS) from:org.apache.hadoop.hive.thrift.client.TUGIAssumingTransport.open(TUGIAssumingTransport.java:49) DEBUG org.apache.thrift.transport.TSaslTransport: opening transport org.apache.thrift.transport.TSaslClientTransport@1f20a0ab ERROR org.apache.thrift.transport.TSaslTransport: SASL negotiation failure javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException:   No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)]     at   com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:212)      at org.apache.thrift.transport.TSaslClientTransport.handleSaslStartMessage(TSaslClientTransport.java:94)     at org.apache.thrift.transport.TSaslTransport.open(TSaslTransport.java:253)     at org.apache.thrift.transport.TSaslClientTransport.open(TSaslClientTransport.java:37)     at org.apache.hadoop.hive.thrift.client.TUGIAssumingTransport$1.run(TUGIAssumingTransport.java:52)     at org.apache.hadoop.hive.thrift.client.TUGIAssumingTransport$1.run(TUGIAssumingTransport.java:49)     at java.security.AccessController.doPrivileged(Native Method)     at javax.security.auth.Subject.doAs(Subject.java:415)     at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1548)     at org.apache.hadoop.hive.thrift.client.TUGIAssumingTransport.open(TUGIAssumingTransport.java:49)     at org.apache.hive.jdbc.HiveConnection.openTransport(HiveConnection.java:156)     at org.apache.hive.jdbc.HiveConnection.(HiveConnection.java:96)     at org.apache.hive.jdbc.HiveDriver.connect(HiveDriver.java:104)

回答1:

Beware, mortal: Kerberos is just black magic. It will suck your soul away. Seriously.

Now, there is very poorly documented way to activate the GSSAPI trace, that is your only hope of zooming on the actual issue (probably a cryptic syntax error in a config file that GSS silently discards by default)

-Djava.security.debug=gssloginconfig,configfile,configparser,logincontext

The original book of spells is there.

回答2:

This link will help you to connect kerberos enabled(kerberised) hive cluster using keytab.

Since you already have a keytab file in place, you additionally need JAAS Config file, Java Subjects abstraction and Java CallbackHandler for a successfull connection. And of course, dependent libraries (jar files) are required.

HTH.

回答3:

http://appcrawler.com/wordpress/2015/06/18/examples-of-connecting-to-kerberos-hive-in-jdbc/

have some working examples for JDBC connection to a kerberized Hive.

Good advice from @Samson Scharfrichter on debugging. +1'd

javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)] at com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:212) at org.apache.thrift.transport.TSaslClientTransport.handleSaslStartMessage(TSaslClientTransport.java:94)

"GSS initiate failed" + "GSSException: No valid credentials provided" normally means your client-side kerberos ticket does not exist or has expired.

Please run klist on client side and copy-paste it here.

转载请标明出处:connect to hive in a secured kerberos authenticated cluster using keytab

文章来源: connect to hive in a secured kerberos authenticated cluster using keytab