使用带有Kerberos身份验证的JDBC连接到配置单元时出现问题

Question

public static void main(String a[])
{

    ...

    connectionString_ = "jdbc:hive2://cdh-542-kerberos.domain.com:10000/default;principal=hive/cdh-542-kerberos.domain.com@REALMDOMAIN";

    UserGroupInformation ugi = createUgi();

    connection = ugi.doAs(new PrivilegedExceptionAction<Connection>() {
        public Connection run() throws Exception {
            Connection connection = null;
            Class.forName(jdbcDriverClass_);
            connection =  DriverManager.getConnection(connectionString_);
            return connection;
        }
    });
    ... 
}



public static UserGroupInformation createUgi() 
{
    try{
        UserGroupInformation ugi = null;
        
        String principal = "hive/cdh-542-kerberos.domain.com@REALMDOMAIN"
        String keyTabLocation = "hive.keytab"
        
        logger.debug("principal:" + principal);
        logger.debug("keyTabLocation:" + keyTabLocation);
        ugi =  createkerbUser( principal, keyTabLocation);
        return ugi;
    }
    catch(Exception e)
    {
        throw new BDEToolSecurityException(BDEToolSecurityException.SECURITYEXCPETION, e);
    }
}

public static UserGroupInformation createkerbUser( String principal, String keyTabFilePath) 
{
    UserGroupInformation app_ugi = UserGroupInformation.loginUserFromKeytabAndReturnUGI(principal, keyTabFilePath);
    String user = getUserfromPrincipal(principal);
    
    if(user.trim().length() > 0){
        UserGroupInformation proxy_ugi = UserGroupInformation.createProxyUser(user, app_ugi);
        return proxy_ugi;
    }
    return app_ugi;
}

private static String getUserfromPrincipal(String principal)
{
    String user = Constants.emptyString;
    
    if(principal.contains(Constants.fSlash)){
        String[]  tokens = principal.split(Constants.fSlash);           
        if(tokens.length > 1){
            user = tokens[0];
        }            
    }       
    return user;
}

java.sql.SQLException: Could not open client transport with JDBC Uri: jdbc:hive2://cdh-542-kerberos.informatica.com:10000/default;principal=hive/cdh-542-kerberos.informatica.com@INFAQAKERB: GSS initiate failed
    at org.apache.hive.jdbc.HiveConnection.openTransport(HiveConnection.java:215)
    at org.apache.hive.jdbc.HiveConnection.<init>(HiveConnection.java:163)
    at org.apache.hive.jdbc.HiveDriver.connect(HiveDriver.java:105)
    at java.sql.DriverManager.getConnection(DriverManager.java:571)
    at java.sql.DriverManager.getConnection(DriverManager.java:233)
    at com.informatica.gcs.tools.bde.connectivity.tool.hive.HiveJdbcTest$1.run(HiveJdbcTest.java:148)
    at com.informatica.gcs.tools.bde.connectivity.tool.hive.HiveJdbcTest$1.run(HiveJdbcTest.java:144)
    at java.security.AccessController.doPrivileged(Native Method)
    at javax.security.auth.Subject.doAs(Subject.java:415)
    at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1671)
    ... 6 more
Caused by: org.apache.thrift.transport.TTransportException: GSS initiate failed
    at org.apache.thrift.transport.TSaslTransport.sendAndThrowMessage(TSaslTransport.java:232)
    at org.apache.thrift.transport.TSaslTransport.open(TSaslTransport.java:316)
    at org.apache.thrift.transport.TSaslClientTransport.open(TSaslClientTransport.java:37)
    at org.apache.hadoop.hive.thrift.client.TUGIAssumingTransport$1.run(TUGIAssumingTransport.java:52)
    at org.apache.hadoop.hive.thrift.client.TUGIAssumingTransport$1.run(TUGIAssumingTransport.java:49)
    at java.security.AccessController.doPrivileged(Native Method)
    at javax.security.auth.Subject.doAs(Subject.java:415)
    at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1671)
    at org.apache.hadoop.hive.thrift.client.TUGIAssumingTransport.open(TUGIAssumingTransport.java:49)
    at org.apache.hive.jdbc.HiveConnection.openTransport(HiveConnection.java:190)
    ... 15 more

keytab和principl似乎都是正确的。我可以成功运行命令

kinit -k -t hive.keytab hive/cdh-542-kerberos.informatica.com@INFAQAKERB

有谁能进一步帮我。我被这个问题困扰了将近一个星期。如果需要，我可以提供更多的信息。

Answer 1

这不是丢失/过期票的问题。否则，错误堆栈也会在“GSS initiate Failed”之后读“GSSException：No valid credentials Provided”。

可能出现的问题：

>

您试图连接到的服务器（配置单元服务器2，端口10000）和您的客户机html" target="_blank">计算机（进行jdbc：Hive连接）似乎在不同的域中。是这样吗？

$ kinit -k -t hive.keytab hive/cdh-542-kerberos.informatica.com@INFAQAKERB (like you did)
$ klist 

• 在服务器端和客户端执行此操作，并在此复制粘贴结果。

“org.apache.hive.jdbc.hiveConnection.opentransport（hiveConnection.java:215)”可以提供一条线索，说明可能是从HS2服务器到域控制器服务器的防火墙/域配置问题。虽然您可以在客户端创建票证，但HS2服务器无法对其进行验证。

在您的代码片段中--查看在JDBC中连接到Kerberos配置单元的示例。

看来您的代码至少缺少了：

UserGroupInformation.setConfiguration(conf);

但不确定它是否与您的用例相关...