I see that you use Active DIrecyory   Did you use the below property?   +++ <property> <name>hive.server2.authentication.ldap.Domain</name> <value>AD_Domain</value> </property> +++ ... View more

In some cases, when a Daemon has troubles with AD connection protocol, from that server it´s impossible to retrieve user-group assignation information.   If your work casually is launched from that server, you obtain an error, but if the work is launched from another server without that problems, you look as the launch was fine.   It´s strange, but a possibility... ... View more

https://issues.apache.org/jira/browse/SENTRY-1001 ... View more

Thanks Harsh J ... View more