question Re: Configuring Sentry via Hue Service Advanced Configuration Snippet (Safety Valve) for sentry-site in Archives of Support Questions (Read Only)

Configuring Sentry via Hue Service Advanced Configuration Snippet (Safety Valve) for sentry-site.xml

nataliaking_csc — Tue, 21 Apr 2026 13:58:57 GMT

I am looking to add Sentry service to Hue. How to I add below config using Cloudera Manager Safety Valve to enable Sentry?

[libsentry]
# Hostname or IP of server.
hostname=localhost

# Port the sentry service is running on.
port=8038

# Sentry configuration directory, where sentry-site.xml is located.
sentry_conf_dir=/etc/sentry/conf

Add'l details:

Kerberos (I know it is a pre-req) - YES

Cloudera version - CDH 5.3

Re: Configuring Sentry via Hue Service Advanced Configuration Snippet (Safety Valve) for sentry-site

Romainr — Fri, 06 Mar 2015 02:56:34 GMT

*Note:* To override a value in Cloudera Manager, you need to enter verbatim
each mini section from below into the Hue Safety Valve
:
Hue Service → Configuration → Service-Wide → Advanced → Hue Service
Advanced Configuration Snippet (Safety Valve) for hue_safety_valve.ini

http://gethue.com/how-to-configure-hue-in-your-hadoop-cluster/

Romain

Re: Configuring Sentry via Hue Service Advanced Configuration Snippet (Safety Valve) for sentry-site

nataliaking_csc — Fri, 06 Mar 2015 03:11:54 GMT

Okay, that worked, I was able to add values I needed. Prior I was mistakenly trying to add config to Hue Service Advanced Configuration Snippet (Safety Valve) for sentry-site.xml instead of Hue Service Advanced Configuration Snippet (Safety Valve) for hue_safety_valve.ini

I am still, however, getting transport error (my theory was that enabling Sentry should have solved that):
Could not connect to localhost:8038 (code THRIFTTRANSPORT): TTransportException('Could not connect to localhost:8038',)

Re: Configuring Sentry via Hue Service Advanced Configuration Snippet (Safety Valve) for sentry-site

nataliaking_csc — Fri, 06 Mar 2015 03:15:27 GMT

I am going to troubleshoot HiveServer2 to make sure everything is running as expected there, as the error could point at some misconfigurations. I do think though that Cloudera Manager would have picked up if an issue with HiveServer2 was detected...

Re: Configuring Sentry via Hue Service Advanced Configuration Snippet (Safety Valve) for sentry-site

nataliaking_csc — Fri, 06 Mar 2015 03:56:15 GMT

# beeline
Beeline version 0.13.1-cdh5.3.0 by Apache Hive
beeline> !connect jdbc:hive2://localhost:10000 org.apache.hive.jdbc.HiveDriver
scan complete in 2ms
Connecting to jdbc:hive2://localhost:10000
Enter password for jdbc:hive2://localhost:10000:
Error: Could not open connection to jdbc:hive2://localhost:10000: Peer indicated failure: Unsupported mechanism type PLAIN (state=08S01,code=0)
0: jdbc:hive2://localhost:10000 (closed)>

With the cluster being Kerberized, looks to me like some config still needs to be added here to enable kerberos vs plain as shown above in an error message.

Re: Configuring Sentry via Hue Service Advanced Configuration Snippet (Safety Valve) for sentry-site

Romainr — Fri, 06 Mar 2015 04:37:34 GMT

localhost:8038 means that Sentry server is not running on the Hue machine.

The other error might be because you don't use the good connection string.
Please check the Cloudera Doc security guide about that

Romain

Re: Configuring Sentry via Hue Service Advanced Configuration Snippet (Safety Valve) for sentry-site

cconner — Fri, 06 Mar 2015 14:08:17 GMT

With a kerberized cluster, your connect string needs to include the HS2 server principal, so:

jdbc:hive2://cdh53-1.qa.test.com:10000/default;principal=hive/cdh53-1.qa.test.com@TEST.COM

replace "cdh53-1.qa.test.com" with your fully qualified host and domain name. Replace TEST.COM with the correct REALM. Any time kerberos is in place, you must use the hostname and fully qualified domain name instead of localhost or hostname as kerberos checks depend on the FQDN. Same is true of the Sentry server in your safety valve configuration, use the FQDN instead of localhost.

Re: Configuring Sentry via Hue Service Advanced Configuration Snippet (Safety Valve) for sentry-site

nataliaking_csc — Fri, 06 Mar 2015 14:32:11 GMT

Added hostname to safety valve and restarted Hue service. Sentry service is definitely not running:

# ps auxfww | grep sentry

and

# netstat -anp | grep 8038

...return nothing, which explains my error in Hue.

However, I was able to test HiveServer2 with beeline shell using above recommendation for the string.

# beeline
Beeline version 0.13.1-cdh5.3.0 by Apache Hive
beeline> !connect jdbc:hive2://MY_FQDN_HOSTNAME:10000/default;principal=hive/MY_FQDN_HOSTNAME@MY_DOMAIN
scan complete in 2ms
Connecting to jdbc:hive2://MY_FQDN_HOSTNAME:10000/default;principal=hive/MY_FQDN_HOSTNAME@MY_DOMAIN
Enter username for jdbc:hive2://MY_FQDN_HOSTNAME:10000/default;principal=hive/MY_FQDN_HOSTNAME@MY_DOMAIN:
Enter password for jdbc:hive2://cjdbc:hive2://MY_FQDN_HOSTNAME:10000/default;principal=hive/MY_FQDN_HOSTNAME@MY_DOMAIN:
Connected to: Apache Hive (version 0.13.1-cdh5.3.0)
Driver: Hive JDBC (version 0.13.1-cdh5.3.0)
Transaction isolation: TRANSACTION_REPEATABLE_READ
0: jdbc:hive2://MY_FQDN_HOSTNAME:10> show databases;
+----------------+--+
| database_name |
+----------------+--+
| default |
| test |
+----------------+--+
2 rows selected (0.178 seconds)

Re: Configuring Sentry via Hue Service Advanced Configuration Snippet (Safety Valve) for sentry-site

Romainr — Fri, 06 Mar 2015 16:17:34 GMT

For Sentry, you need to check if a Sentry service exists, and Hue is
configured to point to it, this is something else than Hue

Re: Configuring Sentry via Hue Service Advanced Configuration Snippet (Safety Valve) for sentry-site

nataliaking_csc — Fri, 06 Mar 2015 16:32:38 GMT

I am going over all steps outlined here http://www.cloudera.com/content/cloudera/en/documentation/core/latest/topics/sg_sentry_service_config.html

1. Permissions

$ sudo -u hdfs hdfs dfs -chmod -R 771 /user/hive/warehouse
$ sudo -u hdfs hdfs dfs -chown -R hive:hive /user/hive/warehous

2. Disabled impersonation for HiveServer2 in the Cloudera Manager Admin Console

3. Set the Minimum User ID for Job Submission property to zero

4. Ensured the Allowed System Users property includes the hive user

5. Unchecked the Enable Sentry Authorization using Policy Files configuration property for both Hive and Impala under the Service-Wide > Policy File Based Sentry

In the Service-Wide category for Hue/Hive/Impala, I will need to set the Sentry Service property to Sentry, but the option is not listed still. Going over all pre-req's again.

Re: Configuring Sentry via Hue Service Advanced Configuration Snippet (Safety Valve) for sentry-site

nataliaking_csc — Fri, 06 Mar 2015 23:30:25 GMT

Followed all steps outlined here http://www.cloudera.com/content/cloudera/en/documentation/core/latest/topics/sg_sentry_service_config.html#concept_z5b_42s_p4_unique_1 (confuguring Sentry with Cloudera Manager) and Sentry is still not running.

Re: Configuring Sentry via Hue Service Advanced Configuration Snippet (Safety Valve) for sentry-site

nataliaking_csc — Sat, 07 Mar 2015 22:26:15 GMT

Got Sentry service successfully added for Hue, Hive and Impala services. I am however now seeing a connection error when I try to load Sentry Tables:

timed out (code THRIFTSOCKET): None

The Hue error.log:

kerberos_ ERROR handle_other(): Mutual authentication unavailable on 200 response

Sentry's log on node it is installed on:

ERROR sentry.org.apache.thrift.server.TThreadPoolServer: Error occurred during processing of message.
java.lang.RuntimeException: sentry.org.apache.thrift.transport.TTransportException
   at sentry.org.apache.thrift.transport.TSaslServerTransport$Factory.getTransport(TSaslServerTransport.java:219)
   at sentry.org.apache.thrift.server.TThreadPoolServer$WorkerProcess.run(TThreadPoolServer.java:227)
   at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
   at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
   at java.lang.Thread.run(Thread.java:745)
Caused by: sentry.org.apache.thrift.transport.TTransportException
   at sentry.org.apache.thrift.transport.TIOStreamTransport.read(TIOStreamTransport.java:132)
   at sentry.org.apache.thrift.transport.TTransport.readAll(TTransport.java:84)
   at sentry.org.apache.thrift.transport.TSaslTransport.receiveSaslMessage(TSaslTransport.java:182)
   at sentry.org.apache.thrift.transport.TSaslServerTransport.handleSaslStartMessage(TSaslServerTransport.java:125)
   at sentry.org.apache.thrift.transport.TSaslTransport.open(TSaslTransport.java:253)
   at sentry.org.apache.thrift.transport.TSaslServerTransport.open(TSaslServerTransport.java:1)
   at sentry.org.apache.thrift.transport.TSaslServerTransport$Factory.getTransport(TSaslServerTransport.java:216)
   ... 4 more

In Cloudera Manager Hue safety valve I have:

[libsentry]
# Hostname or IP of server.
hostname=cdh-foyer.platform.infochimps
# Port the sentry service is running on.
port=8038
# Sentry configuration directory, where sentry-site.xml is located.
sentry_conf_dir=/etc/sentry/conf

sentry-site.xml has default settings for "sentry.service.security.mode". It seems I should need to specify Kerberos here instead of "none", not sure if that is a requirement here is this config.

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <property>
        <name>sentry.service.security.mode</name>
        <value>none</value>
    </property>
    <property>
        <name>sentry.service.admin.group</name>
        <value>admin1</value>
    </property>
    <property>
        <name>sentry.service.allow.connect</name>
        <value>impala,hive,solr</value>
    </property>
    <property>
        <name>sentry.store.jdbc.url</name>
        <value>jdbc:derby:;databaseName=sentry_store_db;create=true</value>
    </property>
    <property>
        <name>sentry.store.jdbc.driver</name>
        <value>org.apache.derby.jdbc.EmbeddedDriver</value>
    </property>
</configuration>

Re: Configuring Sentry via Hue Service Advanced Configuration Snippet (Safety Valve) for sentry-site

nataliaking_csc — Sat, 07 Mar 2015 23:03:54 GMT

Got everything to work! Thanks all for useful tips. Uninstalled and did another clean install - this time ensured that Sentry server is installed on same node where Hue, Hive and Impala services are also installed. My FreeIPA user does not have sufficient privileges to create roles but I will fix that 🙂

Re: Configuring Sentry via Hue Service Advanced Configuration Snippet (Safety Valve) for sentry-site

Romainr — Sun, 08 Mar 2015 02:11:34 GMT

Great!

And for information, look at the Hue configuration section and look at
Sentry, you should just need to check it and it will configure Hue
automatically (no need to use any safety valve or put the Sentry service on
the same host as Hue)

Romain