Support Questions
Find answers, ask questions, and share your expertise
Announcements
Alert: Welcome to the Unified Cloudera Community. Former HCC members be sure to read and learn how to activate your account here.

Access to Hive from Oozie java action with Kerberos

Solved Go to solution
Highlighted

Re: Access to Hive from Oozie java action with Kerberos

Contributor

@Guillermo Ortiz I would say it is Oozie/Kerberos problem. If I would like to call HBase from Oozie (there is probably not a task for it), I would end up with the same problem.

Highlighted

Re: Access to Hive from Oozie java action with Kerberos

@Pavel Benes

I know it has been forever. But its possible to provide a password file to beeline. So they might not have to log on. Similar to a keytab the file would be stored in their account.

Re: Access to Hive from Oozie java action with Kerberos

Contributor

The problem is that our system does not have access to users password or keytab. It uses kerberos authentication and than Haddop proxy user to access various Hadoop services. So it is not possible for us to do kinit again on a data node or use password (in file or directly).

Highlighted

Re: Access to Hive from Oozie java action with Kerberos

I am also trying to execute hive query through oozie java action on kerberized environment (https://community.hortonworks.com/questions/23857/executing-hive-queries-through-oozie-java-action-o.html). I tried above solution, but still I am facing issue.

Highlighted

Re: Access to Hive from Oozie java action with Kerberos

@Pavel Benes - Can you modify the source of the program that gets executed Java Action? If so, you can include the kinit as part of the java code.

See below link -

https://community.hortonworks.com/questions/1807/c...

Highlighted

Re: Access to Hive from Oozie java action with Kerberos

Contributor

@bsaini I can modify the action code, but I cannot do the kinit there since I do not have access to user's keytab at all. My scenario is like this:

  • the user is logged in company network (with Kerberos)
  • the user access the REST API of some application server (authenticated using Kerberos)
  • the application server runs Oozie workflow, that includes the java task that needs to access some tables in Hive using the original user credentials.

The only way I see is the delegation token. Even if Oozie would support kinit on data, it still is no help, since the keytab/password is not available.

Highlighted

Re: Access to Hive from Oozie java action with Kerberos

New Contributor

Did you get a solution?

Highlighted

Re: Access to Hive from Oozie java action with Kerberos

@Pavel Benes Did you get the solution. I am facing the similar issue. My java application writes the result to HDFS and it needs kerberos authentication. When schedule my application using oozie. I am facing this issue.

Highlighted

Re: Access to Hive from Oozie java action with Kerberos

Contributor

@Padmanabhan Vijendran

Actually I did not, since the need passed. However my question was more about access to Hive. In case of HDFS it should be more simple.

In your java code you need to have something like this:

if (System.getenv("HADOOP_TOKEN_FILE_LOCATION") != null) {
            jobConf.set("mapreduce.job.credentials.binary", System.getenv("HADOOP_TOKEN_FILE_LOCATION"));
}

to tell your java app where to find delegation token needed for HDFS access.

Hope this helps,

Pavel

Highlighted

Re: Access to Hive from Oozie java action with Kerberos

@Pavel Benes

Did you fixed the hive issues in Java Action from oozie ?

Don't have an account?
Coming from Hortonworks? Activate your account here