question Re: How to enable Hive SASL on kerberized cluster? in Archives of Support Questions (Read Only)

How to enable Hive SASL on kerberized cluster?

sunile_manjee — Wed, 09 Mar 2016 11:29:12 GMT

On kerberized cluster I understand for j/odbc via TCP only SASL is supported. How do i enabled SASL via ambari for hiveserver2. I only see SSL button.

Re: How to enable Hive SASL on kerberized cluster?

amcbarnett — Wed, 09 Mar 2016 11:43:30 GMT

hive.server2.thrift.sasl.qop in hive-site.xml has to be set to one of the valid QOP values ('auth', 'auth-int' or 'auth-conf').

https://cwiki.apache.org/confluence/display/Hive/Setting+Up+HiveServer2#SettingUpHiveServer2-Integrity/ConfidentialityProtection

Then use as for example:

jdbc:hive://hostname/dbname;sasl.qop=auth-int|auth|auth-conf

jdbc:hive2://sandbox.hortonworks.com:10001/default;principal=hive/sandbox.hortonworks.com@HORTONWORKS.COM?transportMode=http;httpPath=cliservice;auth=kerberos;sasl.qop=auth-int

See

https://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.3.4/bk_Security_Guide/content/ch_wire-connect.html

Re: How to enable Hive SASL on kerberized cluster?

sunile_manjee — Wed, 09 Mar 2016 12:38:05 GMT

@Ancil McBarnett Awesome feedback! I have follow up (maybe I will ask another HCC question). Can client connect using a lower standard like auth-int or auth if hive.server2.thrift.sasl.qop is set to auth-conf on hiveserver2?

Re: How to enable Hive SASL on kerberized cluster?

mherring — Wed, 09 Mar 2016 22:37:24 GMT

Hi @Sunile Manjee please ask the follow on as a separate question.