HiveServer2 Security Configuration

If you configure HiveServer2 to use Kerberos authentication, HiveServer2 acquires a Kerberos ticket during start-up. HiveServer2 requires a principal and keytab file specified in the configuration. The client applications (for example JDBC or Beeline) must get a valid Kerberos ticket before initiating a connection to HiveServer2.

<property>
  <name>hive.server2.authentication</name>
  <value>KERBEROS</value>
</property>
<property>
  <name>hive.server2.authentication.kerberos.principal</name>
  <value>hive/_HOST@YOUR-REALM.COM</value>
</property>
<property>
  <name>hive.server2.authentication.kerberos.keytab</name>
  <value>/etc/hive/conf/hive.keytab</value>
</property>

String url = "jdbc:hive2://node1:10000/default;principal=hive/HiveServer2Host@YOUR-REALM.COM"
Connection con = DriverManager.getConnection(url);

$ /usr/lib/hive/bin/beeline
beeline> !connect jdbc:hive2://localhost:10000/default;principal=hive/HiveServer2Host@YOUR-REALM.COM
0: jdbc:hive2://localhost:10000/default>

As an alternative to Kerberos authentication, you can configure HiveServer2 to use user and password validation backed by LDAP. In this case, the client sends a user name and password during the connection initiation. HiveServer2 validates these credentials using an external LDAP service.

<property>
  <name>hive.server2.authentication</name>
  <value>LDAP</value>
</property>
<property>
  <name>hive.server2.authentication.ldap.url</name>
  <value>LDAP_URL</value>
</property>
<property>
  <name>hive.server2.authentication.ldap.Domain</name>
  <value>DOMAIN</value>
</property>

<property>
  <name>hive.server2.authentication</name>
  <value>LDAP</value>
</property>
<property>
  <name>hive.server2.authentication.ldap.url</name>
  <value>LDAP_URL</value>
</property>
<property>
  <name>hive.server2.authentication.ldap.baseDN</name>
  <value>LDAP_BaseDN</value>
</property>

String url = "jdbc:hive2://node1:10000/default;user=LDAP_Userid;password=LDAP_Password"
Connection con = DriverManager.getConnection(url);

HiveServer2 supports LDAP username/password authentication for clients. Clients send LDAP credentials to HiveServer2 which in turn verifies them with the configured LDAP provider such as OpenLDAP or Microsoft's Active Directory. Most vendors now support LDAPS (LDAP over SSL), an authentication protocol that uses SSL to encrypt communication between the LDAP service and its client (in this case, HiveServer2) to avoid sending LDAP credentials in cleartext.

Perform the following steps to configure the LDAPS service with HiveServer2:

• Import either the LDAP server issuing Certificate Authority's SSL certificate into a local truststore, or import the SSL server certificate for a specific trust. If you import the CA certificate, HiveServer2 will trust any server with a certificate issued by the LDAP server's CA. If you only import the SSL certificate for a specific trust, HiveServer2 will trust only that server. In both cases, the SSL certificate must be imported on to the same host as HiveServer2. Refer the keytool documentation for more details.
• Make sure the truststore file is readable by the hive user.
• Set the hive.server2.authentication.ldap.url configuration property in hive-site.xml to the LDAPS URL. For example, ldaps://sample.myhost.com.
• Set the environment variable HADOOP_OPTS as follows. You can refer the Creating Java Keystores and Truststores topic for details on adding CA certificates to existing truststores or creating new truststores:

  HADOOP_OPTS="-Djavax.net.ssl.trustStore=<trustStore-file-path> -Djavax.net.ssl.trustStorePassword=<trustStore-password>"

  For clusters managed by Cloudera Manager, go to the Hive service and select Configuration > View and Edit. Under the HiveServer2 category, go to the Advanced section and set the HiveServer2 Environment Safety Valve property.
• Restart HiveServer2.

Pluggable authentication allows you to provide a custom authentication provider for HiveServer2.

To enable pluggable authentication:

1. Set the following properties in /etc/hive/conf/hive-site.xml:

   <property>
     <name>hive.server2.authentication</name>
     <value>CUSTOM</value>
     <description>Client authentication types.
     NONE: no authentication check
     LDAP: LDAP/AD based authentication
     KERBEROS: Kerberos/GSSAPI authentication
     CUSTOM: Custom authentication provider
     (Use with property hive.server2.custom.authentication.class)
     </description>
   </property>
   
   <property>
     <name>hive.server2.custom.authentication.class</name>
     <value>pluggable-auth-class-name</value>
     <description>
     Custom authentication class. Used when property
     'hive.server2.authentication' is set to 'CUSTOM'. Provided class
     must be a proper implementation of the interface
     org.apache.hive.service.auth.PasswdAuthenticationProvider. HiveServer2
     will call its Authenticate(user, passed) method to authenticate requests.
     The implementation may optionally extend the Hadoop's
     org.apache.hadoop.conf.Configured class to grab Hive's Configuration object.
     </description>
   </property>

2. Make the class available in the CLASSPATH of HiveServer2.

HiveServer2 determines the identity of the connecting user from the underlying authentication subsystem (Kerberos or LDAP). Any new session started for this connection runs on behalf of this connecting user. If the server is configured to proxy the user at the Hadoop level, then all MapReduce jobs and HDFS accesses will be performed with the identity of the connecting user. If Apache Sentry is configured, then this connecting userid can also be used to verify access rights to underlying tables, views and so on.

In CDH 4.5, a connecting user (for example, hue) with Hadoop-level superuser privileges, can request an alternate user for the given session. HiveServer2 will check if the connecting user has Hadoop-level privileges to proxy the requested userid (for example, bob). If it does, then the new session will be run on behalf of the alternate user, bob, requested by connecting user, hue.

# Login as super user Hue 
kinit hue -k -t hue.keytab hue@MY-REALM.COM

# Connect using following JDBC connection string 
# jdbc:hive2://myHost.myOrg.com:10000/default;principal=hive/_HOST@MY-REALM.COM;hive.server2.proxy.user=bob

To enable impersonation in HiveServer2:

1. Add the following property to the /etc/hive/conf/hive-site.xml file and set the value to true. (The default value is false.)

   <property>
     <name>hive.server2.enable.impersonation</name>
     <description>Enable user impersonation for HiveServer2</description>
     <value>true</value>
   </property>

2. In HDFS or MapReduce configurations, add the following property to the core-site.xml file:

   <property>
     <name>hadoop.proxyuser.hive.hosts</name>
     <value>*</value>
   </property>
   <property>
     <name>hadoop.proxyuser.hive.groups</name>
     <value>*</value>
   </property>

See also File System Permissions.

• Add a firewall rule on the metastore service host to allow access to the metastore port only from the HiveServer2 host. You can do this using iptables.
• Grant access to the metastore database only from the metastore service host. This is specified for MySQL as:

  GRANT ALL PRIVILEGES ON metastore.* TO 'hive'@'metastorehost';

  where metastorehost is the host where the metastore service is running.
• Make sure users who are not admins cannot log on to the host on which HiveServer2 runs.

Hive's security related metadata is stored in the configuration file hive-site.xml. The following sections describe how to disable security for the Hive service.

<property>
  <name>hive.server2.authentication</name>
  <value>NONE</value>
  <description>
    Client authentication types.
       NONE: no authentication check
       LDAP: LDAP/AD based authentication
       KERBEROS: Kerberos/GSSAPI authentication
       CUSTOM: Custom authentication provider
               (Use with property hive.server2.custom.authentication.class)
  </description>
</property>