question Re: LDAP: error code 49 when setting LDAP auth for HiveServer2 in Support Questions

LDAP: error code 49 when setting LDAP auth for HiveServer2

Adija1 — Mon, 19 Aug 2019 09:05:29 GMT

Hello Gurus :) HDP 2.3.2 Ambari 2.1.2.1

I'm trying to setup HiveServer2 with LDAP authentication. It seems pretty straightforward: I performed the following: Changed HiveServer2 Authentication to LDAP

Then i setup my LDAP server url (as the Ambari requested): Restarted the Hive but hiveserver2.log shows the following during it's startup: ERROR [HiveServer2-Handler-Pool: Thread-56]: transport.TSaslTransport (TSaslTransport.java:open(315)) - SASL negotiation failure javax.security.sasl.SaslException: Error validating the login [Caused by javax.security.sasl.AuthenticationException: Error validating LDAP user [Caused by javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 52e, v1db1]]]

According to the error LDAP 49 - 52e the problem is with the credentials that were passed to the LDAP server. I don't find any field \ parameter in which i set the LDAP user & password for authentication... Needless to say that the authentication acts as if it is set to NONE (which is a major problem....)

Any ideas ? Thanks in advance Adi J.

Re: LDAP: error code 49 when setting LDAP auth for HiveServer2

Adija1 — Wed, 10 Feb 2016 00:22:29 GMT

@Neeraj Sabharwal

Re: LDAP: error code 49 when setting LDAP auth for HiveServer2

nsabharwal — Wed, 10 Feb 2016 00:23:04 GMT

@Adi Jabkowsky Looking into it 😉

Re: LDAP: error code 49 when setting LDAP auth for HiveServer2

nsabharwal — Wed, 10 Feb 2016 00:24:00 GMT

@Adi Jabkowsky

Please see this guide https://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.3.2/bk_dataintegration/content/enabling_hs2_for_ldap_and_ldapssl.html

Re: LDAP: error code 49 when setting LDAP auth for HiveServer2

nsabharwal — Wed, 10 Feb 2016 00:50:45 GMT

@Adi Jabkowsky

You should use beeline and provide ldap username and password during the authentication.

Re: LDAP: error code 49 when setting LDAP auth for HiveServer2

Adija1 — Wed, 10 Feb 2016 01:08:03 GMT

@Neeraj Sabharwal The beeline in the documentation is just an example for how to test the configuration.

My problem is when i use third party querying tools such as SQLdeveloper (or even IBM cognos) - i'm able to connect to the hive, see tables and query - without providing any password or with providing wrong password (As if the Security is set to NONE).

Re: LDAP: error code 49 when setting LDAP auth for HiveServer2

Adija1 — Wed, 10 Feb 2016 01:08:21 GMT

The HiveServer2 acts the same if the security is set to LDAP or NONE, and it shouldn't. When set to NONE - as long as my user has authorization for a specific table - i can query it without authentication against LDAP. (hence - NONE. no Authentication needed). When set to LDAP, if setup is correct, i won't be able to query anything without connecting using my credentials.

Re: LDAP: error code 49 when setting LDAP auth for HiveServer2

Adija1 — Wed, 10 Feb 2016 01:08:35 GMT

During the HiveServer2 startup i see that error in the log (52e) - so HiveServer2 has some sort of configuration problem regarding LDAP. There must be a property in which i setup a user & password for HS2 to check authentication against LDAP but i can't find any...

(I've managed to configure Ambari to use LDAP, and HUE to use LDAP, and even Ranger's user sync - all of them use a manager DN or a bind DN. But where is this value in HS2 config ??

Re: LDAP: error code 49 when setting LDAP auth for HiveServer2

nsabharwal — Wed, 10 Feb 2016 01:57:03 GMT

@Adi Jabkowsky

Can you send me your hive-site.xml?

Re: LDAP: error code 49 when setting LDAP auth for HiveServer2

amiller — Wed, 10 Feb 2016 02:12:42 GMT

As described in the docs:

If you're using AD you should also define a custom hive-site property hive.server2.authentication.ldap.Domain

If you're using OpenLDAP you should also define a custom hive-site property hive.server2.authentication.ldap.baseDN

Also make sure to force HiveServer2 to restart in Ambari. Go to the host(s) running HS2, and use the drop-down next to HiveServer2 to 'Restart' which will push the new configs. There was an Ambari bug that would mark all other Hive components for restart, but NOT HS2, even when it's required, and the "Restart All Affected" will NOT push new HS2 configs in that case.

Re: LDAP: error code 49 when setting LDAP auth for HiveServer2

nsabharwal — Wed, 10 Feb 2016 03:30:20 GMT

@Adi Jabkowsky

adldap.txt

See if you can set this up

Re: LDAP: error code 49 when setting LDAP auth for HiveServer2

Adija1 — Wed, 10 Feb 2016 15:07:00 GMT

@Alex Miller Hi Alex and thank you for your reply. I did add the hive.server2.authentication.ldap.Domain property with my domain name, and i'm configuring everything while HIVE is completely shutdown - so it's definitely not a restart problem. What i don't understand is where do i setup the user that is in charge of authentication against AD ? Where is the manager dn value located ? Maybe it's also a custom value ?

Re: LDAP: error code 49 when setting LDAP auth for HiveServer2

Adija1 — Wed, 10 Feb 2016 15:17:38 GMT

@Neeraj Sabharwal Sure, hive-site.xml FYI - i've marked out the domain controller name for security reasons. In the original file the real name is there of course.

Re: LDAP: error code 49 when setting LDAP auth for HiveServer2

nsabharwal — Wed, 10 Feb 2016 17:34:22 GMT

@Adi Jabkowsky Thanks! Did you the text file that I shared?

Re: LDAP: error code 49 when setting LDAP auth for HiveServer2

Adija1 — Wed, 10 Feb 2016 17:57:58 GMT

@Neeraj Sabharwal

I went through the text file you uploaded and you can see these values in my hive-site.xml file. LDAP is there and also the LDAP url. I also added hive.server2.authentication.ldap.Domain because we use Active Directory (Not openLDAP). What i'm missing is the manager dn. There has to be a value where i set a user for authenticating against Active Directory but i don't find anything in your documentation about it. I did setup authentication for HUE & Ambari without problems and both use a specific user for authentication...

Re: LDAP: error code 49 when setting LDAP auth for HiveServer2

nsabharwal — Wed, 10 Feb 2016 17:59:43 GMT

@Adi Jabkowsky Is your system/server synced with AD? When I enabled LDAP for hive, I did follow this http://hortonworks.com/blog/hadoop-groupmapping-ldap-integration/

Re: LDAP: error code 49 when setting LDAP auth for HiveServer2

Adija1 — Wed, 10 Feb 2016 18:52:47 GMT

@Neeraj Sabharwal This documentation is about group mapping. It is useful when you want to add permission to groups from AD to HDFS (this is why the mapping is done in core-site.xml which is in HDFS). Unfortunately it has nothing to do with hive authentication :( If your hive is set to authenticate against AD - could you maybe look in your hiveserver2.log and check for anything regarding LDAP during hive startup ? Maybe it will give a clue.

Re: LDAP: error code 49 when setting LDAP auth for HiveServer2

nsabharwal — Wed, 10 Feb 2016 18:59:49 GMT

@Adi Jabkowsky Thats the option when your server is not synced with LDAP

Is your system/server synced with AD? Are you able to login to server using AD account?

Re: LDAP: error code 49 when setting LDAP auth for HiveServer2

Adija1 — Wed, 10 Feb 2016 19:05:59 GMT

@Neeraj Sabharwal The linux server where hive is installed isn't connected to AD. We only use local accounts. But - hive is a service, just like Ambari & Hue. To Ambari & Hue which are running on the same machine we login using our AD accounts, because those services are configured to authenticate using AD.

Re: LDAP: error code 49 when setting LDAP auth for HiveServer2

nsabharwal — Wed, 10 Feb 2016 19:09:44 GMT

@Adi Jabkowsky

What error do you get when you login to beeline and provide your LDAP username and password? I am getting this error

2: jdbc:hive2://localhost:10000 (closed)> !connect jdbc:hive2://localhost:10000

Connecting to jdbc:hive2://localhost:10000

Enter username for jdbc:hive2://localhost:10000: aa

Enter password for jdbc:hive2://localhost:10000: **

Error: Could not open client transport with JDBC Uri: jdbc:hive2://localhost:10000: Peer indicated failure: Error validating the login (state=08S01,code=0)

3: jdbc:hive2://localhost:10000 (closed)>