question Hue Impala query run user with kerberos? in Support Questions

Hue Impala query run user with kerberos?

ben123 — Fri, 16 Sep 2022 10:17:48 GMT

Hello

Why does Hue run Impala query as 'hue/master1@MY-REALM' instead my username 'ben'?

I get this error (even i'm logged-in as 'ben' user)

Your query has the following error(s):

Request from user 'hue/master1@MY-REALM' with requested pool 'it' denied access to assigned pool 'root.it'

Previous to Cloudera 5.7 i think Cloudera had llama service and ran Impala query as 'llama' user. Now with Cloudera 5.7 I could have Impala without llama and have it's own Dynamic Resource Management. but problem is Hue runs query as hue/master1... user instead of my username.

Similar thing happens to Hive. Hive runs hive query as 'hive' user instead of my username. I found it pretty annoying..

Does anyone has better idea to this?

Ben

Re: Hue Impala query run user with kerberos?

Romainr — Mon, 09 May 2016 16:32:16 GMT

Is impersonation turned on on the Hue side and Impala side?

For hue
https://github.com/cloudera/hue/blob/master/desktop/conf.dist/hue.ini#L867

Re: Hue Impala query run user with kerberos?

ben123 — Tue, 10 May 2016 15:01:10 GMT

I added this configuration to Hue Server

[impala]
impersonation_enabled=True

Now i get this error

User 'hue/master1@MYREALM.COM' is not authorized to delegate to 'ben'. User delegation is disabled.

Re: Hue Impala query run user with kerberos?

Romainr — Mon, 16 May 2016 03:51:16 GMT

Do you have impersonation ON on the the Impala side?

https://groups.google.com/a/cloudera.org/forum/#!topic/hue-user/RNbjg2v7Zcc

Re: Hue Impala query run user with kerberos?

ben123 — Mon, 16 May 2016 16:17:09 GMT

I have had authorized_proxy_user_config=hue=* configuration on CM, but for some reason it wasn't being populated on impalad configuration.

after reading the post you provided me, instead of manually adding it to "advanced snippet", I enabled Sentry Authorization on Impala. Now the configuration appears on the impalad, and impersonation works fine.

Thank you for your help Romain

Ben