"HiveServer2 and the Hive Metastore running with strong authentication. For HiveServer2, strong authentication is either Kerberos or LDAP. For the Hive Metastore, only Kerberos is considered strong authentication."
Is that mean if I want sentry work with ldap authentication hive,hive metastore must run with kerbreos,and hive server2 run with ldap.It makes me confused,how to config hive-site.xml.
Kerberos authentication is a given for a secure environment. However, it absolutely makes sense to also provide LDAP authentication for JDBC/ODBC clients. This is common. Currently you need to choose either Kerberos or LDAP for a single HiveServer2, but this is changing imminently to be like Impalad, where a single instance can support either authentication method. Keep in mind that this is just authentication from clients to the service. From that service to the rest of the internal cluster, Kerberos is used.
Please can you ellaborate on this ? Is the feature, to support either LDAP or Kerberos Authentication for HS2 already part of the latest/current CDH release? I did not find good documentation for setting up Sentry + Hive - to support HS2 with LDAP authentication in non-testing mode.
@soundy Yes the feature already exists in CDH to allow HiveServer2 to be configured for both Kerberos and LDAP authentication at the same time, just like Impala. You don't need any "testing mode" configurations or anything like that.