Re: Failure in the Kerberos authentication to Hive metastore

2017-07-27 Thread wenxing zheng
Thanks to Shakti. It works now. Since the web application uses the underlying mechanism to get the credentials, after adding the "-Djavax.security.auth.useSubjectCredsOnly=false", we are now able to connec to metastore now. On Fri, Jul 28, 2017 at 10:37 AM, shakti singh Shekhawat < shaktisingh.sh

Re: Failure in the Kerberos authentication to Hive metastore

2017-07-27 Thread shakti singh Shekhawat
Hi Wenxing, Can you please refer the below Oracle link which has solution for all common Kerberos authentication issues and it helped us solve our issue: http://docs.oracle.com/javase/7/docs/technotes/guides/security/jgss/tutorials/Troubleshooting.html The issue you mentioned *GSSException: No va

Re: Failure in the Kerberos authentication to Hive metastore

2017-07-27 Thread wenxing zheng
adding more information. hive.metastore.HiveMetaStoreClientTest is doing the same thing as the codes above. and the SHELL script works after we got the ticket with the kinit #!/usr/bin/env bash > > export HIVE_LIBS_DIR=lib/ > export JAVA_OPTS='-Xdebug > -Xrunjdwp:transport=dt_socket,server=y,susp

Re: Failure in the Kerberos authentication to Hive metastore

2017-07-27 Thread wenxing zheng
Hello Shakti The configurations mentioned in the link above are all OK and we are able to connect to Hive from Kylin and Hive CLI. Even we are able to connect to meta store in a JAR package but run with classpath setting with HIVE_CONF_DIR. In our web applications, what we are doing is like the c

Re: Failure in the Kerberos authentication to Hive metastore

2017-07-27 Thread shakti singh Shekhawat
Hi Wenxing, Some of the changes I can see in hive-site.xml in Kerberized cluster as compared to our non-kerberized one is: hive.metastore.*sasl.enabled* --> *true --This property is false in non-kerberized cluster* hive.server2.authentication --> KERBEROS Adding the below links(please refer a

Re: Failure in the Kerberos authentication to Hive metastore

2017-07-26 Thread wenxing zheng
In my web application, I am using the HiveMetaStoreClient setting with kerberized hive-site.xml. Any preconditions to met for the HiveMetaStoreClient to work correctly? On Thu, Jul 27, 2017 at 2:02 PM, wenxing zheng wrote: > still didn't determine the root cause. And happened to find a JIRA rel

Re: Failure in the Kerberos authentication to Hive metastore

2017-07-26 Thread wenxing zheng
still didn't determine the root cause. And happened to find a JIRA related with my issue: https://issues.cloudera.org/browse/DISTRO-610. On Thu, Jul 27, 2017 at 11:41 AM, wenxing zheng wrote: > Thanks to Shkti. Will have a try immediately. > > On Thu, Jul 27, 2017 at 11:15 AM, shakti singh She

Re: Failure in the Kerberos authentication to Hive metastore

2017-07-26 Thread wenxing zheng
Thanks to Shkti. Will have a try immediately. On Thu, Jul 27, 2017 at 11:15 AM, shakti singh Shekhawat < shaktisingh.shekhawa...@gmail.com> wrote: > Hi Wenxing, > > We recently had the same GSS Tgt issue when we moved to a Kerberized > cluster. The solution that worked for us was "Create a file t

Re: Failure in the Kerberos authentication to Hive metastore

2017-07-26 Thread shakti singh Shekhawat
Hi Wenxing, We recently had the same GSS Tgt issue when we moved to a Kerberized cluster. The solution that worked for us was "Create a file to define Java krb5login and name it as jaas.conf or jaas.java". Jaas authentication makes Java applications independent of underlying authentication technol

Failure in the Kerberos authentication to Hive metastore

2017-07-26 Thread wenxing zheng
Dear all, We have a Hive in 2.1.1 and a web application running against the Hive server. Before enabling the Kerberos, everything is OK. But after enabling the Kerberos, it always failed to do the authentication. - web application runs with: Jetty, hive client version: 1.2.1 and JDK 1.7