question Re: Hive SASL QOP setting on client and server in Archives of Support Questions (Read Only)

Hive SASL QOP setting on client and server

sunile_manjee — Thu, 10 Mar 2016 00:04:39 GMT

Can client connect using a lower standard like auth-int or auth if hive.server2.thrift.sasl.qop is set to auth-conf on hiveserver2?

Re: Hive SASL QOP setting on client and server

aervits — Sun, 03 Apr 2016 04:18:28 GMT

Did you ever get a solution for this?

Re: Hive SASL QOP setting on client and server

sunile_manjee — Sun, 03 Apr 2016 07:12:35 GMT

@Artem Ervits

yes here is the info:

HiveServer2 implemented encryption with the Java SASL protocol's quality of protection (QOP) setting that allows data moving between a HiveServer2 over JDBC and a JDBC client to be encrypted. For kerberized cluster hiveserver2 binary transport uses sasl qop.

QOP property can be set to:

"auth" - authentication only
"auth-int" - authentication plus integrity protection
"auth-conf" - authentication plus integrity and confidentiality protection

This enhancement is available in hive .12+. It was made available via HIVE-4911. Please be aware of performance degradation due to encryption. Great example on the bottom of the jira.

Re: Hive SASL QOP setting on client and server

aanghel — Fri, 23 Sep 2016 20:14:05 GMT

I feel that this wasn't answered clearly.

I stumbled across this recently and tested with various configurations and full packet captures with tcpdump.

There are 3 possibilities when hive.server2.thrift.sasl.qop is set to auth-conf:

Client connects with ;saslQop=auth-conf - traffic is encrypted
Client tries to connect with ;saslQop=auth - connection is refused with javax.security.sasl.SaslException: No common protection layer between client and server exception
Client connects without any saslQop parameter set (this is especially the case with ODBC drivers and software such as Tableau where you cannot - easily - set the JDBC parameters) - traffic is still encrypted. I'm mentioning this as some documentation asks to explicitly set saslQop in the client, but this isn't required, unless you want to enforce this so it doesn't go over unencrypted connections if the server setting changes.