訪問開啟kerberos的hive (HDP)
Hive版本：1.2.1
1.通過hive用戶訪問
- 切換用戶為hive
[root@slave conf]# su - hive
上一次登錄：五 4月 12 13:59:19 CST 2019pts/1 上
[hive@slave ~]$
- 命令行直接輸入hive就可以進(jìn)入hive
[hive@slave ~]$ hive
log4j:WARN No such property [maxFileSize] in org.apache.log4j.DailyRollingFileAppender.
Logging initialized using configuration in file:/etc/hive/2.6.5.0-292/0/hive-log4j.properties
hive>
2.其他用戶訪問hive
- 其他用戶為授權(quán)訪問hive會(huì)出現(xiàn)以下問題
java.io.IOException: Failed on local exception: java.io.IOException: javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)]; Host Details : local host is: "kjss1.example.com/172.26.69.237"; destination host is: "kjss2.example.com":8020;
at org.apache.hadoop.net.NetUtils.wrapException(NetUtils.java:782)
at org.apache.hadoop.ipc.Client.getRpcResponse(Client.java:1556)
at org.apache.hadoop.ipc.Client.call(Client.java:1496)
at org.apache.hadoop.ipc.Client.call(Client.java:1396)
at org.apache.hadoop.ipc.ProtobufRpcEngine$Invoker.invoke(ProtobufRpcEngine.java:233)
at com.sun.proxy.$Proxy8.getGroupsForUser(Unknown Source)
at org.apache.hadoop.tools.protocolPB.GetUserMappingsProtocolClientSideTranslatorPB.getGroupsForUser(GetUserMappingsProtocolClientSideTranslatorPB.java:57)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:497)
at org.apache.hadoop.io.retry.RetryInvocationHandler.invokeMethod(RetryInvocationHandler.java:278)
at org.apache.hadoop.io.retry.RetryInvocationHandler.invoke(RetryInvocationHandler.java:194)
at org.apache.hadoop.io.retry.RetryInvocationHandler.invoke(RetryInvocationHandler.java:176)
at com.sun.proxy.$Proxy9.getGroupsForUser(Unknown Source)
at org.apache.hadoop.tools.GetGroupsBase.run(GetGroupsBase.java:71)
at org.apache.hadoop.util.ToolRunner.run(ToolRunner.java:76)
at org.apache.hadoop.util.ToolRunner.run(ToolRunner.java:90)
at org.apache.hadoop.hdfs.tools.GetGroups.main(GetGroups.java:96)
Caused by: java.io.IOException: javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)]
at org.apache.hadoop.ipc.Client$Connection$1.run(Client.java:720)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAs(Subject.java:422)
at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1724)
at org.apache.hadoop.ipc.Client$Connection.handleSaslConnectionFailure(Client.java:683)
at org.apache.hadoop.ipc.Client$Connection.setupIOstreams(Client.java:770)
at org.apache.hadoop.ipc.Client$Connection.access$3200(Client.java:397)
at org.apache.hadoop.ipc.Client.getConnection(Client.java:1618)
at org.apache.hadoop.ipc.Client.call(Client.java:1449)
... 16 more
Caused by: javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)]
at com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:211)
at org.apache.hadoop.security.SaslRpcClient.saslConnect(SaslRpcClient.java:413)
at org.apache.hadoop.ipc.Client$Connection.setupSaslConnection(Client.java:595)
at org.apache.hadoop.ipc.Client$Connection.access$2000(Client.java:397)
at org.apache.hadoop.ipc.Client$Connection$2.run(Client.java:762)
at org.apache.hadoop.ipc.Client$Connection$2.run(Client.java:758)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAs(Subject.java:422)
at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1724)
at org.apache.hadoop.ipc.Client$Connection.setupIOstreams(Client.java:757)
... 19 more
Caused by: GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)
at sun.security.jgss.krb5.Krb5InitCredential.getInstance(Krb5InitCredential.java:147)
at sun.security.jgss.krb5.Krb5MechFactory.getCredentialElement(Krb5MechFactory.java:122)
at sun.security.jgss.krb5.Krb5MechFactory.getMechanismContext(Krb5MechFactory.java:187)
at sun.security.jgss.GSSManagerImpl.getMechanismContext(GSSManagerImpl.java:224)
at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:212)
at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:179)
at com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:192)
... 28 more
- 查看該用戶是否有kerberos 憑證
[root@slave conf]# su - nifi
上一次登錄：三 4月 3 17:32:05 CST 2019pts/0 上
[nifi@slave ~]$ klist
klist: No credentials cache found (filename: /tmp/krb5cc_996)
[nifi@slave ~]$
- 如果沒有看到有效的憑證誉察，執(zhí)行如下命令。
/etc/security/keytabs/hive.service.keytab為hive kerberos文件
[nifi@slave ~]$ klist -kte /etc/security/keytabs/hive.service.keytab
Keytab name: FILE:/etc/security/keytabs/hive.service.keytab
KVNO Timestamp Principal
---- ------------------- ------------------------------------------------------
1 2019-04-11T17:02:35 hive/slave.hdp193.com@EXAMPLE.COM (des3-cbc-sha1)
1 2019-04-11T17:02:35 hive/slave.hdp193.com@EXAMPLE.COM (arcfour-hmac)
1 2019-04-11T17:02:35 hive/slave.hdp193.com@EXAMPLE.COM (des-cbc-md5)
1 2019-04-11T17:02:35 hive/slave.hdp193.com@EXAMPLE.COM (aes128-cts-hmac-sha1-96)
1 2019-04-11T17:02:35 hive/slave.hdp193.com@EXAMPLE.COM (aes256-cts-hmac-sha1-96)
[nifi@slave ~]$
- 執(zhí)行后就可以在該用戶下執(zhí)行kinit麸俘。
# 驗(yàn)證用戶是否可以從keytab文件登錄：
[nifi@slave ~]$ kinit -kt /etc/security/keytabs/hive.service.keytab hive/slave.hdp193.com@EXAMPLE.COM
# 查看有效的憑證
[nifi@slave ~]$ klist
Ticket cache: FILE:/tmp/krb5cc_996
Default principal: hive/slave.hdp193.com@EXAMPLE.COM
Valid starting Expires Service principal
2019-04-12T14:36:32 2019-04-13T14:36:32 krbtgt/EXAMPLE.COM@EXAMPLE.COM
[nifi@slave ~]$
- 在該用戶下執(zhí)行hive即可進(jìn)入hive命令界面
