AD Kerberized cluster Hive connection string

[#1]

I have some question about the hive jdbc connection string for AD Kerberized cluster.

Hive server: qwang-hdp2

Hive clients: qwang-hdp0, qwang-hdp2, qwang-hdp4

I could connect using beeline using following conn string

beeline -u "jdbc:hive2://qwang-hdp2:10000/default;principal=hive/qwang-hdp2@REALM.NAME"

But not this conn string

beeline -u "jdbc:hive2://qwang-hdp2:10000/default;principal=hive/qwang-hdp0@REALM.NAME"

The only difference is the hive principal, got the following error

Error: Could not open client transport with JDBC Uri: jdbc:hive2://qwang-hdp2:10000/default;principal=hive/qwang-hdp0@REALM.NAME: Peer indicated failure: GSS initiate failed (state=08S01,code=0)

Root is under hadoopadmin principal

[root@qwang-hdp0 ~]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: hadoopadmin@REALM.NAME

Also keytabs are available

[root@qwang-hdp0 ~]# klist -kt /etc/security/keytabs/hive.service.keytab
Keytab name: FILE:/etc/security/keytabs/hive.service.keytab
KVNO Timestamp           Principal
---- ------------------- ------------------------------------------------------
   0 11/02/2016 20:35:50 hive/qwang-hdp0@REALM.NAME
   0 11/02/2016 20:35:50 hive/qwang-hdp0@REALM.NAME
   0 11/02/2016 20:35:50 hive/qwang-hdp0@REALM.NAME
   0 11/02/2016 20:35:50 hive/qwang-hdp0@REALM.NAME
   0 11/02/2016 20:35:50 hive/qwang-hdp0@REALM.NAME

Could you suggest any way to trouble shoot why this is happening?

[#2 · Accepted solution]

Hi

The Hive principal is not a headless principal , ie the hive principal is dedicated to the HiveServer2 Server .

So the Principal name always pooints to the Hiveserver2 , which in your case is

qwang-hdp2. So if you are able to login using

beeline -u "jdbc:hive2://qwang-hdp2:10000/default;principal=hive/qwang-hdp2@REALM.NAME"


Then you are good.