Hive Metastore supports Kerberos authentication for Thrift clients only. HiveServer does not support Kerberos authentication for any clients.

To the hive-site.xml file on every host in your cluster, add the following information:

Following is the XML for these entries:

<property> 
     <name>hive.metastore.sasl.enabled</name> 
     <value>true</value> 
     <description>If true, the metastore thrift interface will be secured with SASL. 
     Clients must authenticate with Kerberos.</description> 
</property> 
 
<property> 
     <name>hive.metastore.kerberos.keytab.file</name> 
     <value>/etc/security/keytabs/hive.service.keytab</value> 
     <description>The path to the Kerberos Keytab file containing the
     metastore thrift server's service principal.
     </description> 
</property> 
 
<property> 
     <name>hive.metastore.kerberos.principal</name> 
     <value>hive/_HOST@EXAMPLE.COM</value> 
     <description>The service principal for the metastore thrift server. The
     special string _HOST will be replaced automatically with the correct 
     hostname.</description> 
</property> 
 
<property> 
     <name>hive.metastore.cache.pinobjtypes</name> 
     <value>Table,Database,Type,FieldSchema,Order</value> 
     <description>List of comma separated metastore object types that should be pinned in
     the cache
     </description> 
</property>