About yagoaparecidoti

yagoaparecidoti · ‎09-15-2022

hi @araujo the userPrincipalName of user livy is: livy/hostname_livy_server@DOMAIN.LOCAL the userPrincipalName of the livy-http user is: livy-http@DOMAIN.LOCAL running the command "kinit livy": running the command "kinit livy-http": running the "kinit" command with the keytab created for user livy: running the command "kinit" with the keytab created for the user livy-http: we've been facing this problem for months, we haven't found the solution yet.

yagoaparecidoti · ‎09-12-2022

hi @Scharan the same goes for sentry?

yagoaparecidoti · ‎09-12-2022

hi @Scharan so, does the ranger only work the permissions if it uses beeline or connections that access the hiveserver2 address?

yagoaparecidoti · ‎09-12-2022

we are using ambari 2.6.2.2 with hdp 2.6.5 the permissions are being managed by the ranger, but checking the ranger settings, it's only managing the /apps/hive/warehouse directory on the hdfs the problem we are having is in the /area/data/pll directory on the hdfs, this directory has acl rwx permission for the user using beeline to create an external table is returning the error: Error: Error while compiling statement: FAILED: HiveAccessControlException Permission denied: user [service_user] does not have [ALL] privilege on [hdfs://service1/area/data/pll] (state=42000,code=40000) but using hive cli does not return error, table is created successfully. What could be causing this problem?

yagoaparecidoti · ‎08-30-2022

hi @araujo yes, we know the passwords, because we created these two users from scratch before creating the keytabs for the two users, we managed to kinit the two users without problem "kinit user", after creating the keytabs for the two users, kinit only works with the keytab, but it only works on the livy user, when we try to run kinit in livy-http user keytab displays the error "kinit: Preauthentication failed while getting initial credentials" the userprincipalname of each user is: livy: livy/hostname_livy_server@DOMAIN.LOCAL livy-http: HTTP/hostname_livy_server@DOMAIN.LOCAL

yagoaparecidoti · ‎08-30-2022

hi @araujo this command "SHOW ROLE GRANT GROUP group name" I know and already used, I thought there was a command that did the opposite. well I will check in mysql then and soon return if it worked.

yagoaparecidoti · ‎08-29-2022

hello cloudera community, how can we find out which group is tied to a sentry role by command line?

yagoaparecidoti · ‎08-29-2022

hello cloudera community, could you help us with a problem regarding the /var/log directory at certain times (we couldn't identify the right moment) the /var/log directory is changing the permissions to 750 and with that the CDH 6.3.x cluster services is failing because it can't write the logs. Have you ever had a problem like this? did you manage to solve it? we had to leave a crontab running every 5 minutes to always change it to 755. ps: selinux is disabled ps: firewall is disabled

yagoaparecidoti · ‎08-29-2022

hi @araujo the ad has two users: livy livy-http the user livy has the SPN: livy/hostname@DOMAIN.LOCAL and it is working without problem in kinit the user livy-http has the SPN: HTTP/hostname@DOMAIN.LOCAL but it is showing the error described above

yagoaparecidoti · ‎08-26-2022

hi @araujo to use in the livy service, as requested in the processes in the links below: https://danielfrg.com/blog/2018/08/spark-livy/ https://enterprise-docs.anaconda.com/en/latest/admin/advanced/config-livy-server.html

Online	Offline
Last Visited	‎05-06-2026 10:29 AM

Member Since	‎02-28-2022 11:49 AM
Last Visited	‎05-06-2026 10:29 AM
Posts	171
Kudos received	14

Cloudera Community

Re: How to add Delay during Rolling Restart Until ...

Re: check date and time of access to some kudu tab...

Re: We need developer access to archive.cloudera.c...

Re: how to create a flow in nifi that reads a hive...

Re: how create, export and import full nifi templa...

Re: problem generating keytab with HTTP SPN

Re: permission failure when using beeline

Re: permission failure when using beeline

permission failure when using beeline

Re: problem generating keytab with HTTP SPN

Re: how to know which group is linked to a sentry ...

how to know which group is linked to a sentry role...

/var/log directory is being changed permission to ...

Re: problem generating keytab with HTTP SPN

Re: problem generating keytab with HTTP SPN