LDAP: error code 49 when setting LDAP auth for HiveServer2

[#1]

Hello Gurus :) HDP 2.3.2 Ambari 2.1.2.1

I'm trying to setup HiveServer2 with LDAP authentication. It seems pretty straightforward: I performed the following: Changed HiveServer2 Authentication to LDAP

Then i setup my LDAP server url (as the Ambari requested): Restarted the Hive but hiveserver2.log shows the following during it's startup: ERROR [HiveServer2-Handler-Pool: Thread-56]: transport.TSaslTransport (TSaslTransport.java:open(315)) - SASL negotiation failure javax.security.sasl.SaslException: Error validating the login [Caused by javax.security.sasl.AuthenticationException: Error validating LDAP user [Caused by javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 52e, v1db1]]]

According to the error LDAP 49 - 52e the problem is with the credentials that were passed to the LDAP server. I don't find any field \ parameter in which i set the LDAP user & password for authentication... Needless to say that the authentication acts as if it is set to NONE (which is a major problem....)

Any ideas ? Thanks in advance Adi J.

[#2 · Accepted solution]

@Adi Jabkowsky

Is this happening when HS2 is started ONLY or when you connect via Beeline or both?

Try the following:

1. Your hive.server2.authentication.ldap.baseDN has a blank space. Remove the blank space and restart HS2 from Hosts in Ambari

   #From
   <property>
   <name>hive.server2.authentication.ldap.baseDN</name>
   <value> </value>
   </property>
   
   #To
   <property>
   <name>hive.server2.authentication.ldap.baseDN</name>
   <value></value>
   </property>

2. Remove hive.server2.authentication.ldap.Domain or set to Blank. Then log into HS2 using beeline and set your user to myuser@corp.cellcom.co.il as your login and see if it authenticates
3. Set hive.server2.enable.doAs to False so that Hive user executes the query,
4. If you are using a Hive AD user, Double check that the hive AD UID is the same in /etc/passwd file. Make an archive of HS2 Logs, change /etc/passwd to have the same UUID as the AD hive user, and restart HS2.

[#3]

@Adi Jabkowsky I think it attempts to bind as the user being authenticated.

Additional LDAP properties are available in Hive 1.3:

https://cwiki.apache.org/confluence/display/Hive/Setting+Up+HiveServer2#SettingUpHiveServer2-Authent...

[#4]

@Alex Miller

As far as i know HDP 2.3.4 which the latest available form Hortonworks comes with hive 1.2.1 so if i want a higher version of hive i need to install it separately and it won't be managed under Ambari. I'd rather stay with the current 1.2.1 which is pretty high. Anyways - i really would be glad to get in touch with anyone on this planet who has managed to configure AD authentication for hive :)

[#5]

@Adi Jabkowsky

Please see this ..I am able to login using ldap credentials

You have to have correcy baseDN

[#6]

@Adi Jabkowsky Its openldap

[#7 · Accepted solution]

@Adi Jabkowsky

Is this happening when HS2 is started ONLY or when you connect via Beeline or both?

Try the following:

1. Your hive.server2.authentication.ldap.baseDN has a blank space. Remove the blank space and restart HS2 from Hosts in Ambari

   #From
   <property>
   <name>hive.server2.authentication.ldap.baseDN</name>
   <value> </value>
   </property>
   
   #To
   <property>
   <name>hive.server2.authentication.ldap.baseDN</name>
   <value></value>
   </property>

2. Remove hive.server2.authentication.ldap.Domain or set to Blank. Then log into HS2 using beeline and set your user to myuser@corp.cellcom.co.il as your login and see if it authenticates
3. Set hive.server2.enable.doAs to False so that Hive user executes the query,
4. If you are using a Hive AD user, Double check that the hive AD UID is the same in /etc/passwd file. Make an archive of HS2 Logs, change /etc/passwd to have the same UUID as the AD hive user, and restart HS2.

[#8]

@Ancil McBarnett

Hi Ancil and thank you for your response! Good observation about the blank space ! I removed it and yet unable to authenticate (using beeline). However - i was able to authenticate after disabling the doAs !!! The doAs is important to me because if i understand correct, when doAs is disabled - all of the Hive queries are performed as the hive user and not as the end user. It's a problematic for auditing. I need to know exactly who performed the queries.... I wanna experiment a little bit more and get back to you all with my results.

Thanks!!

[#9]

@Ancil McBarnett

Ancil you hit the nail right on the head ! Here are the final results:

1. When changing hive auth to LDAP in Ambari - a blank space is added to hive.server2.authentication.ldap.baseDN. That is a problem and must be taken care of!

2. Disabling doAs fixes the auth and also maintains the end user that queries ! (So i'm not sure what's the purpose of this value...)

3. hive.server2.authentication.ldap.Domain doesn't work. Only after removing it and using FQDN for authentication works.

Thank you Ancil and thank you all for helping out. This forum is awesome !!

[#10]

Hi, I have exactly the same problem. I have done everything like Adi wrote and still got LDAP 49/52e. I can log in to ldapadmin using the same credentials as beeline rejects the authenticate.

[#11]

@Neeraj Sabharwal Thank you so much for helping !!

[#12]

@Adi jabkowsky With your Previous issue you can use without any changes. You have to enter username@REALM then Password, It will work defiantly 🙂