@Dylan Wu Can you paste the error stacktrace from hive.log? ... View more

@Geoffrey Shelton Okot You can follow instructions similar to this: https://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.4.2/bk_Security_Guide/content/_set_up_truststore_for_ambari_server.html. Basically you'll need to import certificates to your truststore/keystore. ... View more

@Preeti Padelkar Can you post the error trace from client (& server if you have one)? ... View more

@cmcbugg You can use the following jvm options to add additional logging for Kerberos: -Dsun.security.krb5.debug=true -Dsun.security.jgss.debug=true -Djavax.net.debug=all When you run your kafka process at DEBUG log level, it should ideally log the kerberos ticket exchange, which will contain the KDC coordinates. Hope this helps ... View more

@Cruz DSouza It appears that HBase is not in the classpath and that's why the class not found error. Can you try adding hbase jars to your classpath and try again? ... View more

@Marcy For earlier hive versions (and if you are not running Ranger), you can try SQL Standard Auth: https://cwiki.apache.org/confluence/display/Hive/SQL+Standard+Based+Hive+Authorization. However, it is preferred to use Ranger for fine grained authorization. You can find details here: https://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.3.2/bk_Sys_Admin_Guides/content/ref-746ce51a-9bdc-4fef-85a6-69564089a8a6.1.html https://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.3.2/bk_installing_manually_book/content/installing_ranger_plugins.html Hope that helps ... View more

@Morten R. What do you see in HS2 logs and also the application logs? Can you change the log level to DEBUG and then try to get the error stacktrace? ... View more

@Ye Jun Hive web interface (HWI) is a legacy component, which will be removed in next releases from Apache. If you don't plan to use Ambari views, you can use the HiveServer2 Web UI as described here: https://cwiki.apache.org/confluence/display/Hive/Setting+Up+HiveServer2#SettingUpHiveServer2-WebUIforHiveServer2. Hope that helps. ... View more

@jzhang The _HOST in the principal name gets replaced by the fully qualified domain name of the host at runtime. However, this needs the reverse DNS to be configured correctly on the box. Could you check that? ... View more