Zeppelin user impersonation for Hive?

[#1]

Is there any capabilities to hive zeppelin notebook run hive query based on user id on zeppelin session? right know the jdbc interrupter needs username and password for hive. That means all users will run as user defined in interpreter settings. I can't have this due to security issues, ie having all users access hive tables via single user id. I have ranger enabled to provide security based on user id. Livy is for spark so that is unusable for hive. any insights?

[#2 · Accepted solution]

I found how to do it

Identity Propagation with JDBC (Hive)


1.Enable
Authentication via Shiro
Config


–zeppelin.jdbc.auth.type
= KERBEROS


–zeppelin.jdbc.principal
=
principal value


–zeppelin.jdbc.keytab.location
=
keytab
location


•JDBC
Interpreter will add end-user as 

jdbc:hive2://HiveHost:10000/default;principal=hive/[email protected];hive.server2.proxy.user=<$USER_NAME>

[#3]

@Sunile Manjee

Can you clearly state what you entered for zeppelin.jdbc.principal? Is this the Hive Principal or the Zeppelin Principal with Key tab. Also what exactly is in the URL for the JDBC Interpreter? Just:

jdbc:hive2://HiveHost:10000/default;principal=hive/[email protected]

Finally, did you have to copy the Hive JDBC Jars or create softlinks to Zeppelin

/usr/hdp/current/zeppelin-server/interpreter/jdbc

[#4]

@Ancil McBarnett its been a while since I have tried it. here is the information:

https://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.5.3/bk_zeppelin-component-guide/content/zeppeli...