How can I configure HiveServer2 to ask for password ?

[#1]

Hi guys,

When I try to connect to Hiveserver2 via beeline:

beeline> !connect jdbc:hive2://<host>:2181,<host>:2181,<host>:2181/;serviceDiscoveryMode=zooKeeper;zooKeeperNamespace=hiveserver2

I have to enter my credentials:

Enter username for jdbc...: my_username

Enter password for jdbc...:

If I leave password field empty, the connection is established as well. So, the thing is: I have set up Ranger permission to Hive for different external users, but they can connect to Hive without any password.

What can I do?

[#2]

@Ivan Diaz Based on the above details I guess hive.server2.authentication=NONE and hive_security_authorization=RANGER

.

You can restrict user access by setting hive.server2.authentication to KERBEROS/LDAP or other supported authentication methods different than NONE.

.

Furthermore, you can also add ranger policies to allow access only to non anonymous users while having hive_security_authorization=RANGER (hive ranger plugin on). For this you need to add policies on hive repo for group/user and set correct permissions. Once this is correctly configured even when users are able to authenticate with no user/password they wont be able to perform any actions on hiveserver2.

.

HTH

*** If you found this answer addressed your question, please take a moment to login and click the "accept" link on the answer.

[#3]

But I dont have Kerberos or LDAP.

Regarding Ranger policies, that's exactly what I have, but still can perform actions on Hiveserver2 using the username and no password (or wrong password, doesnt matter). I think I am missing something in Ranger configuration. I mean: when I limit user permission for Hive (only Select permission in one DB). I can Select on that DB, but with no password.

So, I dont know if this is Ranger or Hive issue.

[#4]

@Ivan Diaz

AFAIK If you dont select an authentication method users can type any username and password.

You need to select an authentication method other than NONE. If you dont have LDAP and are not willing to do KERBEROS perhaps you can configure PAM -> https://community.hortonworks.com/articles/591/using-hive-with-pam-authentication.html

If you think this answer has helped address your question please remember to take a moment to login and click the "accept" link on the answer.

[#5]

@Ivan Diaz if the above answer helped you please take a moment to login and click the "accept" link on the answer.