Support Questions
Find answers, ask questions, and share your expertise

Query with transform clause is disallowed in current configuration

Query with transform clause is disallowed in current configuration

Expert Contributor
2015-12-09 09:14:54,306 ERROR [HiveServer2-Background-Pool: Thread-60853]: ql.Driver (SessionState.java:printError(833)) - FAILED: Hive Internal Error: org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException(Query with transform clause is disallowed in current configuration.)
org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException: Query with transform clause is disallowed in current configuration.
        at org.apache.hadoop.hive.ql.security.authorization.plugin.DisallowTransformHook.run(DisallowTransformHook.java:34)
        at org.apache.hadoop.hive.ql.Driver.execute(Driver.java:1304)
        at org.apache.hadoop.hive.ql.Driver.runInternal(Driver.java:1177)
        at org.apache.hadoop.hive.ql.Driver.run(Driver.java:1004)
        at org.apache.hadoop.hive.ql.Driver.run(Driver.java:999)
        at org.apache.hive.service.cli.operation.SQLOperation.runQuery(SQLOperation.java:144)
        at org.apache.hive.service.cli.operation.SQLOperation.access$100(SQLOperation.java:69)
        at org.apache.hive.service.cli.operation.SQLOperation$1$1.run(SQLOperation.java:196)
        at java.security.AccessController.doPrivileged(Native Method)
        at javax.security.auth.Subject.doAs(Subject.java:415)
        at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1628)
        at org.apache.hadoop.hive.shims.HadoopShimsSecure.doAs(HadoopShimsSecure.java:536)
        at org.apache.hive.service.cli.operation.SQLOperation$1.run(SQLOperation.java:208)
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471)
        at java.util.concurrent.FutureTask.run(FutureTask.java:262)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
        at java.lang.Thread.run(Thread.java:745)
14 REPLIES 14
Highlighted

Re: Query with transform clause is disallowed in current configuration

Highlighted

Re: Query with transform clause is disallowed in current configuration

Expert Contributor

Thanks Neeraj for your swift response.

we are able to run this query with no issues when we run it in HiveCli which is not recommended. Encountered this error when we run it in beeline.

Hive version we have is 0.14.0.2.2.0.0

If it runs well with HiveCli, i believe it should run with Beeline too...i think it got some thing to do with authentication.

since hiveserver2.log reports: org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException: Query with transform clause is disallowed in current configuration btw: we use beeline as hive client and make connection through Knox, which authenticates against our AD & authorize through Ranger

Highlighted

Re: Query with transform clause is disallowed in current configuration

@Raja Sekhar Chintalapati Ranger works with beeline. You will expect different behavior when you run hive cli thats why the best practice is to avoid hive and stick with beeline

Highlighted

Re: Query with transform clause is disallowed in current configuration

Expert Contributor

@Neeraj Sabharwal is there any fix for this issue? like change in some parameter or anything? when the query failed with above error it doesn't even report in ranger audit.

Highlighted

Re: Query with transform clause is disallowed in current configuration

@Raja Sekhar Chintalapati Transform is disabled for secruity reasons. You have a workaround, hive cli.

Highlighted

Re: Query with transform clause is disallowed in current configuration

Expert Contributor

isn't HiveCli is not secured? there is no authentication too...

Highlighted

Re: Query with transform clause is disallowed in current configuration

Hive CLI is unsecured. You can run any scripts with it. To secure Hive CLI you need to secure the HDFS files directly. See Section 3 in Best Practices for Hive Authorization using Apache Ranger

Highlighted

Re: Query with transform clause is disallowed in current configuration

@Neeraj Sabharwal

we are using Hive-1.2 and Ranger-0.5, we have provided all access to users using Ranger but still it;s giving below error.

0: jdbc:hive2://sandbox:10000/default> select transform(joining_date) using 'datefunc.py' as t from default.employee; Error: Error while processing statement: FAILED: Hive Internal Error: org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException(Query with transform clause is disallowed in current configuration.) (state=08S01,code=12)

Could you please help me resolve the same.

Thanks,

Bhavesh Vadaliya

Highlighted

Re: Query with transform clause is disallowed in current configuration

@Raja Sekhar Chintalapati

Transform function is disabled when hive security is enabled. You can follow this http://docs.hortonworks.com/HDPDocuments/HDP2/HDP-...

to grant permission to transform udf and see if it works.