question Re: Oozie Hive2 action in kerberized cluster using HS2 http transport in Support Questions

Oozie Hive2 action in kerberized cluster using HS2 http transport

pminovic — Tue, 08 Mar 2016 18:12:22 GMT

workflow.xmlTrying to run an Oozie Hive2 action in kerberized cluster with HS2 transport set to http (to support Knox), I'm getting the following error:

ACTION[0000010-1...6-oozie-oozi-W@hive2-node] Exception in addtoJobConforg.apache.hive.service.cli.HiveSQLException: Delegation token only supported over kerberos authentication

I set

jdbcUrl=jdbc:hive2://oozie1.example.com:10000/default;ssl=false;transportMode=http;httpPath=cliservice

and hive principal to hive/hive2.example.com@EXAMPLE.COM and I can see in the log that the final URL was constructed correctly by concat-ing jdbcUrl and the principal, but I get the exception. Has anybody been able to make this run and how? BTW, Hive's doAs=false, as I found some articles claiming this to be the solution, but not for me 😞

Attaching the workflow, it's from Oozie examples, with added credentials and the password. jdbcUrl and the principal are given above.

Re: Oozie Hive2 action in kerberized cluster using HS2 http transport

bleonhardi — Tue, 08 Mar 2016 19:17:29 GMT

Can you share your workflow? Did you add the Hive2Credential in the action?

Actually not completely sure if needed in a Hive2 Action but I assume so. He gets the information like keytab from the hive-site.xml

https://oozie.apache.org/docs/4.2.0/DG_ActionAuthentication.html

Does the same URL work from beeline?

Re: Oozie Hive2 action in kerberized cluster using HS2 http transport

pminovic — Tue, 08 Mar 2016 20:01:21 GMT

Just put the workflow.xml, and yes, the same URL with the principal works from beeline.

Re: Oozie Hive2 action in kerberized cluster using HS2 http transport

thejas — Wed, 09 Mar 2016 02:24:52 GMT

HTTP transport mode of HS2 + kerberos + Oozie Hive2 action is not supported in current releases of HDP. It will be fixed in next maintenance release of HDP 2.4 .

This is the apache jira tracking it - https://issues.apache.org/jira/browse/HIVE-13169

Re: Oozie Hive2 action in kerberized cluster using HS2 http transport

pminovic — Wed, 09 Mar 2016 08:58:42 GMT

Thanks for chiming in! It seems it was resolved just a few days ago. We'll be waiting for the fix.