0

I am trying to execute the hive table query in presto using Kerberos authentication, But it failed

Caused by: com.facebook.presto.spi.PrestoException: Error opening Hive split hdfs://ip-10-13-9-237.xxxx.com:8020/user/hive/warehouse/extended_test_db_hive2.db/table_with_all_data_types/000000_0_copy_2 (offset=0, length=124) using org.apache.hadoop.mapred.TextInputFormat: org.apache.hadoop.security.AccessControlException: SIMPLE authentication is not enabled. Available:[TOKEN, KERBEROS]

Anyone please help

Jack
  • 1
  • 4
  • 1
    Can you provide how you are connecting ? – Matt Andruff Feb 07 '22 at 19:18
  • I am using this URL format presto://host-name:port/database ,connectivity is success,but seems ,its failed with some hive related table execution failed with mentioned error. – Jack Feb 08 '22 at 04:42
  • I'd look into the documentation for presto and how to use it with kerberos. Like I said in my answer below, you aren't passing the required authentication information (Cause of the error) you need to understand how presto passes that information and follow it. – Matt Andruff Feb 08 '22 at 13:35

1 Answers1

0

This error message tells me that you aren't actually using the correct authentication mechanism. You presented [nothing] or [user/name password] and it's expecting [Kerberos] or [token]. You likely need to use a different connection string to make sure you connect via kerberos.

Usually you have to change your connection to something like:

jdbc:hive2://[my_hive_server]:[port]/[database];principal=myPrincipel@EXAMPLE.COM

or adjust your jaas config to something like:

com.sun.security.jgss.initiate {
com.sun.security.auth.module.Krb5LoginModule required
useTicketCache=false
doNotPrompt=true
useKeyTab=true
keyTab="<QuerySurge Install Dir>/QuerySurge/agent/mykeytab.keytab"
principal="myPrincipel@EXAMPLE.COM"
};
Matt Andruff
  • 4,974
  • 1
  • 5
  • 21
  • Actually am using presto facebook driver , it's not accept the URL like below ,returns connection is null jdbc:hive2://[my_hive_server]:[port]/[database];principal=myPrincipel@EXAMPLE.COM – Jack Feb 08 '22 at 08:04
  • Every URL will have it's own way to add kerberos information. These where to examples, not necessarily to be followed exactly. – Matt Andruff Feb 08 '22 at 13:29
  • SSL is mandatory for Kerberos authentication? – Jack Feb 09 '22 at 13:56