sentry + ldap + hive confuse

[#1]

hi，

"HiveServer2 and the Hive Metastore running with strong authentication. For HiveServer2, strong authentication is either Kerberos or LDAP. For the Hive Metastore, only Kerberos is considered strong authentication."

Is that mean if I want sentry work with ldap authentication hive,hive metastore must run with kerbreos,and hive server2 run with ldap.It makes me confused,how to config hive-site.xml. 

regards

rube

[#2]

For production environment, Kerberos is the best method of authentication.
If you want to do a proof of concept, LDAP can be used for securing Hive. To override the kerberos requirement, the following property has to be set in sentry-site.xml
<property>
<name>sentry.hive.testing.mode</name>
<value>true</value>
</property>

All other LDAP properties can be set on the Hive configuration page on CM.

[#3]

Kerberos authentication is a given for a secure environment.  However, it absolutely makes sense to also provide LDAP authentication for JDBC/ODBC clients.  This is common.  Currently you need to choose either Kerberos or LDAP for a single HiveServer2, but this is changing imminently to be like Impalad, where a single instance can support either authentication method.  Keep in mind that this is just authentication from clients to the service.  From that service to the rest of the internal cluster, Kerberos is used.

[#4]

https://community.cloudera.com/t5/Batch-SQL-Apache-Hive/hive-ldap-LDAP-error-code-34-invalid-DN/m-p/...
CDH5.5.x，ldap+hive do not work，but CDH5.4.X is ok.
Can you help me out?

[#5]

SpiveyBen,

Is there some sort of roadmap/timeline for support of both LDAP and Kerberos for HS2 clients?

[#6]

Please can you ellaborate on this ? Is the feature, to support either LDAP or Kerberos Authentication for HS2 already part of the latest/current CDH release? I did not find good documentation for setting up Sentry + Hive - to support HS2 with LDAP authentication in non-testing mode.

[#7]

@soundy Yes the feature already exists in CDH to allow HiveServer2 to be configured for both Kerberos and LDAP authentication at the same time, just like Impala.  You don't need any "testing mode" configurations or anything like that.