connect to hive in a secured kerberos authenticate

Question

I am using CDH 5.3.3 and using hive JDBC driver to connect to hive in the secured cluster. I tried to login using keytab using

UserGroupInformation.loginUserFromKeytab(lprincipal, keytabpath);

I have used the following format for hive url.

jdbc:hive2://localhost:10000;AuthMech=1;KrbRealm=EXAMPLE.COM; KrbHostFQDN=hs2.example.com;KrbServiceName=hive

Sample code :

// Authenticating Kerberos principal
System.out.println("Principal Authentication: ");
final String user = "[e-mail]";
final String keyPath = "cloudera.keytab";
UserGroupInformation.loginUserFromKeytab(user, keyPath);
Connection connection = DriverManager.getConnection(url);

Url is in the following format:

jdbc:hive2://localhost:10000;AuthMech=1;KrbRealm=EXAMPLE.COM; KrbHostFQDN=hs2.example.com;KrbServiceName=hive

I get the following exception, I would appreciate if some help is provided in identifying the cause of this issue:

com.cloudera.hive.support.exceptions.GeneralException: CONN_KERBEROS_AUTHENTICATION_ERROR_GET_TICKETCACHE

javax.security.auth.login.LoginException: Unable to obtain Princpal Name for authentication
at com.sun.security.auth.module.Krb5LoginModule.promptForName(Krb5LoginModule.java:800)
at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:671)
at com.sun.security.auth.module.Krb5LoginModule.login(Krb5LoginModule.java:584)
at sun.reflect.NativeMethodAccessorImpl.inv

FOr a differn distribution of cluster, after adding debug, I see the following exception :

DEBUG org.apache.hadoop.security.UserGroupInformation: hadoop login
DEBUG org.apache.hadoop.security.UserGroupInformation: hadoop login commit
DEBUG org.apache.hadoop.security.UserGroupInformation: using kerberos            user:null
DEBUG org.apache.hadoop.security.UserGroupInformation: using local user:UnixPrincipal: user66
DEBUG org.apache.hadoop.security.UserGroupInformation: UGI loginUser:user66 (auth:KERBEROS)
DEBUG org.apache.hadoop.security.UserGroupInformation: PrivilegedAction as:user66 (auth:KERBEROS) from:org.apache.hadoop.hive.thrift.client.TUGIAssumingTransport.open(TUGIAssumingTransport.java:49)
DEBUG org.apache.thrift.transport.TSaslTransport: opening transport org.apache.thrift.transport.TSaslClientTransport@1f20a0ab
ERROR org.apache.thrift.transport.TSaslTransport: SASL negotiation failure
javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException:   No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)]
    at   com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:212)
     at org.apache.thrift.transport.TSaslClientTransport.handleSaslStartMessage(TSaslClientTransport.java:94)
    at org.apache.thrift.transport.TSaslTransport.open(TSaslTransport.java:253)
    at org.apache.thrift.transport.TSaslClientTransport.open(TSaslClientTransport.java:37)
    at org.apache.hadoop.hive.thrift.client.TUGIAssumingTransport$1.run(TUGIAssumingTransport.java:52)
    at org.apache.hadoop.hive.thrift.client.TUGIAssumingTransport$1.run(TUGIAssumingTransport.java:49)
    at java.security.AccessController.doPrivileged(Native Method)
    at javax.security.auth.Subject.doAs(Subject.java:415)
    at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1548)
    at org.apache.hadoop.hive.thrift.client.TUGIAssumingTransport.open(TUGIAssumingTransport.java:49)
    at org.apache.hive.jdbc.HiveConnection.openTransport(HiveConnection.java:156)
    at org.apache.hive.jdbc.HiveConnection.<init>(HiveConnection.java:96)
    at org.apache.hive.jdbc.HiveDriver.connect(HiveDriver.java:104)

Answer 1

http://appcrawler.com/wordpress/2015/06/18/examples-of-connecting-to-kerberos-hive-in-jdbc/

have some working examples for JDBC connection to a kerberized Hive.

Good advice from @Samson Scharfrichter on debugging. +1'd

javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)] at com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:212) at org.apache.thrift.transport.TSaslClientTransport.handleSaslStartMessage(TSaslClientTransport.java:94)

"GSS initiate failed" + "GSSException: No valid credentials provided" normally means your client-side kerberos ticket does not exist or has expired.

Please run klist on client side and copy-paste it here.

Answer 2

Beware, mortal: Kerberos is just black magic. It will suck your soul away. Seriously.

Now, there is very poorly documented way to activate the GSSAPI trace, that is your only hope of zooming on the actual issue (probably a cryptic syntax error in a config file that GSS silently discards by default)

-Djava.security.debug=gssloginconfig,configfile,configparser,logincontext

The original book of spells is there.

Answer 3

This link will help you to connect kerberos enabled(kerberised) hive cluster using keytab.

Since you already have a keytab file in place, you additionally need JAAS Config file, Java Subjects abstraction and Java CallbackHandler for a successfull connection. And of course, dependent libraries (jar files) are required.

HTH.