Created on 02-04-2016 05:47 PM - edited 09-16-2022 03:02 AM
"HiveServer2 and the Hive Metastore running with strong authentication. For HiveServer2, strong authentication is either Kerberos or LDAP. For the Hive Metastore, only Kerberos is considered strong authentication."
Is that mean if I want sentry work with ldap authentication hive,hive metastore must run with kerbreos,and hive server2 run with ldap.It makes me confused,how to config hive-site.xml.
Created 02-25-2016 11:33 AM
Created 02-28-2016 04:19 PM
Kerberos authentication is a given for a secure environment. However, it absolutely makes sense to also provide LDAP authentication for JDBC/ODBC clients. This is common. Currently you need to choose either Kerberos or LDAP for a single HiveServer2, but this is changing imminently to be like Impalad, where a single instance can support either authentication method. Keep in mind that this is just authentication from clients to the service. From that service to the rest of the internal cluster, Kerberos is used.
Created 02-28-2016 07:42 PM
Created 02-29-2016 11:19 AM
Is there some sort of roadmap/timeline for support of both LDAP and Kerberos for HS2 clients?
Created 02-06-2018 08:04 AM
Please can you ellaborate on this ? Is the feature, to support either LDAP or Kerberos Authentication for HS2 already part of the latest/current CDH release? I did not find good documentation for setting up Sentry + Hive - to support HS2 with LDAP authentication in non-testing mode.
Created 02-06-2018 08:07 AM
@soundy Yes the feature already exists in CDH to allow HiveServer2 to be configured for both Kerberos and LDAP authentication at the same time, just like Impala. You don't need any "testing mode" configurations or anything like that.