Support Questions
Find answers, ask questions, and share your expertise
Announcements
Alert: Welcome to the Unified Cloudera Community. Former HCC members be sure to read and learn how to activate your account here.

sentry + ldap + hive confuse

sentry + ldap + hive confuse

Contributor

hi,

 

"HiveServer2 and the Hive Metastore running with strong authentication. For HiveServer2, strong authentication is either Kerberos or LDAP. For the Hive Metastore, only Kerberos is considered strong authentication."

 

Is that mean if I want sentry work with ldap authentication hive,hive metastore must run with kerbreos,and hive server2 run with ldap.It makes me confused,how to config hive-site.xml. 

 

 

regards

 

rube

6 REPLIES 6

Re: sentry + ldap + hive confuse

New Contributor
For production environment, Kerberos is the best method of authentication.
If you want to do a proof of concept, LDAP can be used for securing Hive. To override the kerberos requirement, the following property has to be set in sentry-site.xml
<property>
<name>sentry.hive.testing.mode</name>
<value>true</value>
</property>

All other LDAP properties can be set on the Hive configuration page on CM.
Highlighted

Re: sentry + ldap + hive confuse

Cloudera Employee

Kerberos authentication is a given for a secure environment.  However, it absolutely makes sense to also provide LDAP authentication for JDBC/ODBC clients.  This is common.  Currently you need to choose either Kerberos or LDAP for a single HiveServer2, but this is changing imminently to be like Impalad, where a single instance can support either authentication method.  Keep in mind that this is just authentication from clients to the service.  From that service to the rest of the internal cluster, Kerberos is used.

Re: sentry + ldap + hive confuse

Contributor
https://community.cloudera.com/t5/Batch-SQL-Apache-Hive/hive-ldap-LDAP-error-code-34-invalid-DN/m-p/...
CDH5.5.x,ldap+hive do not work,but CDH5.4.X is ok.
Can you help me out?

Re: sentry + ldap + hive confuse

Contributor

SpiveyBen,

 

Is there some sort of roadmap/timeline for support of both LDAP and Kerberos for HS2 clients?

Re: sentry + ldap + hive confuse

New Contributor

Please can you ellaborate on this ? Is the feature, to support either LDAP or Kerberos Authentication for HS2 already part of the latest/current CDH release? I did not find good documentation for setting up Sentry + Hive - to support HS2 with LDAP authentication in non-testing mode.

Re: sentry + ldap + hive confuse

Cloudera Employee

@soundy Yes the feature already exists in CDH to allow HiveServer2 to be configured for both Kerberos and LDAP authentication at the same time, just like Impala.  You don't need any "testing mode" configurations or anything like that.

Don't have an account?
Coming from Hortonworks? Activate your account here