question Re: Connecting to Hive in a Kerberized Cluster with local user in Support Questions

Connecting to Hive in a Kerberized Cluster with local user

akash_sabarad — Wed, 22 May 2019 11:18:33 GMT

Hi , we are in the process of creating HDP 2.6 cluster where in RHEL OS will be integrated with AD for authentication.

We will using AD as the KDC.

My question if we create a local UNIX user called HIVEUSER and use any BI tool to connect to HIVE using this user, will the local user be able to get authenticated and access Hive tables in kerberized cluster?

or the HIVEUSER should be in AD?

Re: Connecting to Hive in a Kerberized Cluster with local user

Shelton — Wed, 22 May 2019 19:33:34 GMT

@Akash S

If you have kerberized your cluster using AD, your local user cannot generate a valid Kerberos key unless he/she is present in the AD.

The reason for using AD is to delegate and centralize user creation/authentication/management to Active Directory. You should maybe configure a System Security Services Daemon (SSSD) client to use Active Directory (AD) as an Identity Provider for SSSD

But the best solution is to create your HIVEUSER in AD which will generate the correct keytabs/permission for your user to access hive.

HTH

Re: Connecting to Hive in a Kerberized Cluster with local user

ask_bill_brooks — Thu, 23 May 2019 00:59:02 GMT

The above question and the reply thread below were originally posted in the Community Help Track. On Wed May 22 17:55 UTC 2019, a member of the HCC moderation staff moved it to the Security track. The Community Help Track is intended for questions about using the HCC site itself.

Re: Connecting to Hive in a Kerberized Cluster with local user

Shelton — Sun, 26 May 2019 17:47:30 GMT

@Akash S

Any updates?

Re: Connecting to Hive in a Kerberized Cluster with local user

akash_sabarad — Tue, 25 Jun 2019 02:04:15 GMT

Thank you very much for this answer.