Setting up Analyze to connect to HIVE with Kerberos

These instructions have been tested with the Database Metadata node and the JDBC Query node. The same setup may also work for additional database-related nodes.

Initial Setup

1. Download the HIVE jars for your Hadoop installation. Sample drivers are included below; however, you may need different drivers depending on your version of Hadoop:
   
   HortonWorks
   hive-jdbc-dependencies-3.1.0.jar
   hive-jdbc-standalone-3.1.0.jar
   
   Cloudera
   HiveJDBC42.jar
   
   
2. Place the jars on the Analyze server. It is not recommended to place the files in the main installation directory, since this directory is replaced during upgrades. Make note of the location the drivers are in - the location will be used in a future step.
   
   
3. Your Kerberos admin will need to provide the keytab file and the krd5.conf file specific for your setup. Place these files on the Analyze server and note the location for future steps.
   
   
4. Create a file named gss-jaas.conf with the following specifications. The principal and keyTab settings will need to be updated with actual values. Check with your Kerberos admin if you are unsure what the principal account is. The location of the keytab file is the same location from the previous step.
   
   Hortonworks example:
   

   com.sun.security.jgss.initiate {
    com.sun.security.auth.module.Krb5LoginModule required
    useKeyTab=true
    useTicketCache=true
    principal="yourprincipaluser@yourcompany.com"
    keyTab="/location/to/your.keytab"
    debug=false;
   };

   Cloudera example:
   

   Client {
    com.sun.security.auth.module.Krb5LoginModule required
    useKeyTab=true
    useTicketCache=true
    principal="yourprincipaluser@yourcompany.com"
    keyTab="/location/to/your.keytab"
    debug=false;
   };

Node properties

1. Add the JDBC Query or the Database Metadata node to your canvas
   
   
2. Click on the node within your canvas to open the node's property pane.
   
   
3. Add your JDBC URL to the DbUrl property. The URL will look similar to:
   

   jdbc:hive2://XXXXXXXXXXX:10000/default;principal=hive/XXXXXX@INFOGIX.COM

   Note: there may be specific requirements for your JDBC URL - please refer to your database admin and/or Kerberos admin to configure the URL appropriately. 
4. Add the following to the DbDriver property:

   org.apache.hive.jdbc.HiveDriver

5. Add the directory location of your Hive drivers into the DbDriverClassPath property. The directory specified must match the location of the Hive drivers from the Initial Setup section.
   
   
6. Enable Hidden Properties in the node property's menu:
   
7. Scroll to the bottom of the properties and open the Parameters 2 property group.
   
   
8. Add the following to the JvmArguments property. There are two similarly named properties;  this must be added to JvmArguments and not the _JvmArguments with an underscore in front.
   
   Each JVM argument needs to remain on an individual line, and the location of the gss-jaas.conf and krb5.conf file will need to be updated with the actual locations from the Initial Setup section:
   

   -Djava.security.auth.login.config=/location/to/gss-jaas.conf
   -Djava.security.krb5.conf=/location/to/krb5.conf
   -Djavax.security.auth.useSubjectCredsOnly=false

9. Run the node