本文详细记录了在Ambari集群上启用Kerberos的安全认证过程中遇到的各种问题及解决办法，包括YARN资源配置错误、Hive与HBase的Kerberos连接、HDFS和Kylin的Kerberos配置、Zepplin和DBeaver的访问设置，以及Ranger权限管理的配合使用。在Kerberos环境下，各种组件的配置和调试成为关键，任何细节都可能导致启动失败或功能受限。
网上一些跟Ambari启用Kerberos，看似很简单，但实际按照这个配置，遇到的问题连解决方案都不好找。启用了kerberos，想要也没有那么简单，ambari关闭kerberos，大数据集群起都起不来，因为有些内容还得手工删除，真是骑虎难下。我之前开启了ranger，比较简单。后来想着kerberos也一样，于是也起来，结果发现安全模式下，会更改ambari的一些配置，导致一堆报错
Remove ats-hbase before switching between clusters，出了问题找这篇文章，才知道切换之前应该先卸载ats-hbase，可是大多数文章都不会有这些。
Ambari集群启用Kerberos安全认证
这里说把 krb5.conf kadm5.acl kdc.conf 复制到另外机器上,实际只需要复制一个krb5.conf就可以，其他两个在客户端机器上不会有影响。
在ambari中查看Tez Service Check，发现检查失败检查的原因也是yarn resouce manager 没有起来造成的
检查yarn的配置，发现Advanced yarn-hbase-site中zookeeper.znode.parent少了个配置atsv2-hbase-unsecure,应该为/atsv2-hbase-unsecure，
无意间少敲了一个/，这个问题导致排查了两天，一切均在细节里面,更正过来，Resource Manager正常启动了，这种问题在网上也真是不会找到了。tez check也正常了
1 yarn中的配置会改
yarn中下图的配置之前是/atsv2-hbase-unsecure，但是开启kerberos之后，这个会变成/atsv2/hbase/secure，而这个时候因为yarn resource manager找不到zookeeper中的配置信息，就会一直报错。
2 hive启用kerberos
安装pyhive的依赖，sasl安装依赖Microsoft Visual C++ 14.0，下载地址为
sasl‑0.2.1‑cp37‑cp37m‑win_amd64.whl
#pip install sasl
pip install sasl-0.2.1-cp37-cp37m-win_amd64.whl
pip install thrift
pip install thrift-sasl
pip install PyHive
# -*- coding: utf-8 -*-
from pyhive.hive import connect
con = connect(host='bg4.test.com.cn',port=10000,auth='KERBEROS',kerbers_service_name='hive')
cursor = con.cursor()
cursor.execute('select * from student')
datas = cursor.fetchall()
print(datas)
cursor.close()
con.close()
开启kerberos后，hive连接不是那么直接，没用好会提示下面的错误，在window机器上执行会提示
Traceback (most recent call last):
File "f:/pywork/bigdata/hive_test.py", line 3, in <module>
PS F:\pywork\bigdata> & D:/Python/Python37/python.exe f:/pywork/bigdata/hive_test.py
Traceback (most recent call last):
File "f:/pywork/bigdata/hive_test.py", line 3, in <module>
con = connect(host='bg4.test.com.cn',port=10000,auth='KERBEROS',kerberos_service_name='hive')
File "D:\Python\Python37\lib\site-packages\pyhive\hive.py", line 94, in connect
return Connection(*args, **kwargs)
File "D:\Python\Python37\lib\site-packages\pyhive\hive.py", line 192, in __init__
self._transport.open()
File "D:\Python\Python37\lib\site-packages\thrift_sasl\__init__.py", line 85, in open
message=("Could not start SASL: %s" % self.sasl.getError()))
thrift.transport.TTransport.TTransportException: Could not start SASL: b'Error in sasl_client_start (-4) SASL(-4): no mechanism available: Unable to find a callback: 2'
在hive的服务器上yum install cyrus-sasl-plain cyrus-sasl-devel cyrus-sasl-gssapi gcc-c++ -y
如果不安装gcc-c++，那么安装sasl的时候会提示下面的错误，这个就跟windows下面要安装vs14++原理是一样的。
gcc -pthread -Wno-unused-result -Wsign-compare -DNDEBUG -g -fwrapv -O3 -Wall -fPIC -Isasl -I/usr/local/python3/include/python3.8 -c sasl/saslwrapper.cpp -o build/temp.linux-x86_64-3.8/sasl/saslwrapper.o
gcc: error trying to exec 'cc1plus': execvp: No such file or directory
error: command 'gcc' failed with exit status 1
把刚刚那段代码，在服务器上执行，提示错误信息
Traceback (most recent call last):
File "hive_test.py", line 3, in <module>
con = connect(host='bg4.test.com.cn',port=10000,auth='KERBEROS',kerberos_service_name='hive')
File "/usr/local/python3/lib/python3.8/site-packages/pyhive/hive.py", line 94, in connect
return Connection(*args, **kwargs)
File "/usr/local/python3/lib/python3.8/site-packages/pyhive/hive.py", line 192, in __init__
self._transport.open()
File "/usr/local/python3/lib/python3.8/site-packages/thrift_sasl/__init__.py", line 84, in open
raise TTransportException(type=TTransportException.NOT_OPEN,
thrift.transport.TTransport.TTransportException: Could not start SASL: b'Error in sasl_client_start (-1) SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (No Kerberos credentials available (default cache: /tmp/krb5cc_0))'
换一种方式,通过impyla来连接hive
pip install impyla - https://pypi.tuna.tsinghua.edu.cn/simple
脚本如下，执行成功.这个impala.dbapi是impyla来操作hive，我还以为需要装impala，我多虑了。
# _*_ coding:utf-8 _*_
import os
from krbcontext import krbcontext
from impala.dbapi import connect
keytab_file = '/etc/security/keytabs/hive.service.keytab'
user = 'hive/bg8.test.com.cn@HADOOP.COM'
def _connect(host,port,sso_ticket=None):
try:
active_str = 'kinit -kt {0} {1}'.format(keytab_file, user)
os.system(active_str)
with krbcontext(using_keytab=True, principal=user, keytab_file=keytab_file):
conn = connect(host=host, port=port, auth_mechanism='GSSAPI', kerberos_service_name='hive')
cursor = conn.cursor()
cursor.execute("insert into student(id,name,sex) values(3,'zhangsan','man')")
cursor.execute("insert into student(id,name,sex) values(4,'wangyu','man')")
cursor.execute("insert into student(id,name,sex) values(5,'zhaoliu','woman')")
cursor.execute('select * from student')
datas = cursor.fetchall()
print(datas)
cursor.close()
conn.close()
except Exception as e:
raise e
if __name__ == '__main__':
_connect('bg8.test.com.cn',10000)
在服务器上执行结果如下,这个是hive的内表
[root@bg8 scrpits]# python3 hive_test_2.py
[(1, 'xiaoming', 'boy', 15, 'dep'), (2, 'dd', 'boy', 35, 'dep'), (3, 'zhangsan', 'man', None, None), (4, 'wangyu', 'man', None, None), (5, 'zhaoliu', 'woman', None, None)]
上面这能算是入门级的，因为上面的student是MANAGED_TABLE,也就是hive的内表。
如果是hive的EXTERNAL_TABLE，就有些区别了,内外表可以通过命令desc formatted student来查看。
接下来实验改成外表cursor.execute("select count(*) from test.ods_ri_category")可以查询出结果。
继而，再进一步做一次验证，通过hive向外表cursor.execute("insert into pro.kylin_intermediate_ods_jd_category2_82e06390_c8ad_2fe2_84bc_76c01bea2ae4 values('2021-01-23','20210123')")中写入数据,写入正常。
最后在验证，从外表查询数据，将结果再写入到另外一张表中。
INSERT OVERWRITE TABLE `pro.kylin_intermediate_ods_jd_category2_82e06390_c8ad_2fe2_84bc_76c01bea2ae4` SELECT
`ODS_JD_CATEGORY`.`UPDATE_DATE` as `ODS_JD_CATEGORY_UPDATE_DATE`
,`ODS_JD_CATEGORY`.`ID` as `ODS_JD_CATEGORY_ID`
FROM `PRO`.`ODS_JD_CATEGORY` as `ODS_JD_CATEGORY`
WHERE 1=1 AND (`ODS_JD_CATEGORY`.`UPDATE_DATE` >= '2021-01-14' AND `ODS_JD_CATEGORY`.`UPDATE_DATE` < '2021-01-15');
接着就出现了困扰已久的问题,如下面所示：
Error while processing statement: FAILED: Execution Error, return code 2 from org.apache.hadoop.hive.ql.exec.tez.TezTask. Vertex failed, vertexName=Map 1, vertexId=vertex_1611301884780_0075_1_00, diagnostics=[Vertex vertex_1611301884780_0075_1_00 [Map 1] killed/failed due to:ROOT_INPUT_INIT_FAILURE, Vertex Input: ods_jd_category initializer failed, vertex=vertex_1611301884780_0075_1_00 [Map 1], org.apache.hadoop.hbase.client.RetriesExhaustedException: Failed after attempts=16, exceptions:
Sat Jan 23 14:27:20 CST 2021, null, java.net.SocketTimeoutException: callTimeout=60000, callDuration=68737: Connection closed row 'pro:ods_jd_category,,' on table 'hbase:meta' at region=hbase:meta,,1.1588230740, hostname=bg3.test.com.cn,16020,1611149386882, seqNum=-1
at org.apache.hadoop.hbase.client.RpcRetryingCallerWithReadReplicas.throwEnrichedException(RpcRetryingCallerWithReadReplicas.java:298)
at org.apache.hadoop.hbase.client.ScannerCallableWithReplicas.call(ScannerCallableWithReplicas.java:242)
at org.apache.hadoop.hbase.client.ScannerCallableWithReplicas.call(ScannerCallableWithReplicas.java:58)
at org.apache.hadoop.hbase.client.RpcRetryingCallerImpl.callWithoutRetries(RpcRetryingCallerImpl.java:192)
at org.apache.hadoop.hbase.client.ClientScanner.call(ClientScanner.java:268)
at org.apache.hadoop.hbase.client.ClientScanner.loadCache(ClientScanner.java:436)
at org.apache.hadoop.hbase.client.ClientScanner.nextWithSyncCache(ClientScanner.java:311)
at org.apache.hadoop.hbase.client.ClientScanner.next(ClientScanner.java:596)
at org.apache.hadoop.hbase.MetaTableAccessor.scanMeta(MetaTableAccessor.java:754)
at org.apache.hadoop.hbase.MetaTableAccessor.scanMeta(MetaTableAccessor.java:670)
at org.apache.hadoop.hbase.MetaTableAccessor.scanMetaForTableRegions(MetaTableAccessor.java:665)
at org.apache.hadoop.hbase.client.HRegionLocator.listRegionLocations(HRegionLocator.java:152)
at org.apache.hadoop.hbase.client.HRegionLocator.getAllRegionLocations(HRegionLocator.java:88)
at org.apache.hadoop.hbase.mapreduce.RegionSizeCalculator.getRegionServersOfTable(RegionSizeCalculator.java:103)
at org.apache.hadoop.hbase.mapreduce.RegionSizeCalculator.init(RegionSizeCalculator.java:79)
at org.apache.hadoop.hbase.mapreduce.RegionSizeCalculator.<init>(RegionSizeCalculator.java:61)
at org.apache.hadoop.hbase.mapreduce.TableInputFormatBase.oneInputSplitPerRegion(TableInputFormatBase.java:294)
at org.apache.hadoop.hbase.mapreduce.TableInputFormatBase.getSplits(TableInputFormatBase.java:257)
at org.apache.hadoop.hive.hbase.HiveHBaseTableInputFormat.getSplitsInternal(HiveHBaseTableInputFormat.java:349)
at org.apache.hadoop.hive.hbase.HiveHBaseTableInputFormat.access$200(HiveHBaseTableInputFormat.java:68)
at org.apache.hadoop.hive.hbase.HiveHBaseTableInputFormat$2.run(HiveHBaseTableInputFormat.java:271)
at org.apache.hadoop.hive.hbase.HiveHBaseTableInputFormat$2.run(HiveHBaseTableInputFormat.java:269)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAs(Subject.java:422)
at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1730)
at org.apache.hadoop.hive.hbase.HiveHBaseTableInputFormat.getSplits(HiveHBaseTableInputFormat.java:269)
at org.apache.hadoop.hive.ql.io.HiveInputFormat.addSplitsForGroup(HiveInputFormat.java:524)
at org.apache.hadoop.hive.ql.io.HiveInputFormat.getSplits(HiveInputFormat.java:779)
at org.apache.hadoop.hive.ql.exec.tez.HiveSplitGenerator.initialize(HiveSplitGenerator.java:243)
at org.apache.tez.dag.app.dag.RootInputInitializerManager$InputInitializerCallable$1.run(RootInputInitializerManager.java:278)
at org.apache.tez.dag.app.dag.RootInputInitializerManager$InputInitializerCallable$1.run(RootInputInitializerManager.java:269)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAs(Subject.java:422)
at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1730)
at org.apache.tez.dag.app.dag.RootInputInitializerManager$InputInitializerCallable.call(RootInputInitializerManager.java:269)
at org.apache.tez.dag.app.dag.RootInputInitializerManager$InputInitializerCallable.call(RootInputInitializerManager.java:253)
at com.google.common.util.concurrent.TrustedListenableFutureTask$TrustedFutureInterruptibleTask.runInterruptibly(TrustedListenableFutureTask.java:108)
at com.google.common.util.concurrent.InterruptibleTask.run(InterruptibleTask.java:41)
at com.google.common.util.concurrent.TrustedListenableFutureTask.run(TrustedListenableFutureTask.java:77)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:748)
我没搞懂这个异常是什么意思，于是执行命令echo "scan 'hbase:meta'" | hbase shell > hbaseout1.txt,将hbase:meta导出来看看。
Hive with HBase (both Kerberos) java.net.SocketTimeoutException … on table ‘hbase:meta’，这个人遇到的问题，跟我的有些像。
3 hbase启用kerberos
启动kerberos之后，直接进入到hbase shell中是查不到东西的
[root@bg8 ~]# su - hbase
Last login: Fri Jan 22 17:42:30 CST 2021
-bash-4.2$ hbase shell
SLF4J: Class path contains multiple SLF4J bindings.
SLF4J: Found binding in [jar:file:/usr/hdp/3.1.0.0-78/phoenix/phoenix-5.0.0.3.1.0.0-78-server.jar!/org/slf4j/impl/StaticLoggerBinder.class]
SLF4J: Found binding in [jar:file:/usr/hdp/3.1.0.0-78/hadoop/lib/slf4j-log4j12-1.7.25.jar!/org/slf4j/impl/StaticLoggerBinder.class]
SLF4J: See http://www.slf4j.org/codes.html#multiple_bindings for an explanation.
SLF4J: Actual binding is of type [org.slf4j.impl.Log4jLoggerFactory]
HBase Shell
Use "help" to get list of supported commands.
Use "exit" to quit this interactive shell.
For Reference, please visit: http://hbase.apache.org/2.0/book.html#shell
Version 2.0.2.3.1.0.0-78, r, Thu Dec 6 12:27:45 UTC 2018
Took 0.0014 seconds
hbase(main):001:0> list
TABLE
ERROR: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)
这个时候就需要采取下面的方式
su - hbase
kinit -kt /etc/security/keytabs/hbase.headless.keytab hbase-xxx@HADOOP.COM
hbase shell
# 接着你就可以执行之如list之类的命令
接下来参考https://github.com/normal-cock/happybase-kerberos-patch,
安装pip install -U git+https://github.com/littlebear-xbz/happybase-kerberos-patch.git -i https://pypi.tuna.tsinghua.edu.cn/simple
写一个脚本在服务器上执行
# -*- coding: utf-8 -*-
from happybase_kerberos_patch import KerberosConnection, KerberosConnectionPool
connection = KerberosConnection('bg2.test.com.cn', protocol='compact', use_kerberos=True)
test_table = connection.table('test:student')
test_table.put('0001', {'o:id':'1'})
test_table.put('0001', {'o:name':'superstart'})
test_table.put('0001', {'o:sex':'man'})
print(test_table.row('0001'))
执行之后提示下面的错误,连接超时.
Traceback (most recent call last):
File "hbase_test_2.py", line 3, in <module>
connection = KerberosConnection('bg2.test.com.cn', protocol='compact', use_kerberos=True)
File "/usr/local/python3/lib/python3.8/site-packages/happybase_kerberos_patch.py", line 225, in __init__
self.open()
File "/usr/local/python3/lib/python3.8/site-packages/happybase/connection.py", line 176, in open
self.transport.open()
File "/usr/local/python3/lib/python3.8/site-packages/happybase_kerberos_patch.py", line 92, in open
status, challenge = self.recv_sasl_msg()
File "/usr/local/python3/lib/python3.8/site-packages/happybase_kerberos_patch.py", line 118, in recv_sasl_msg
header = readall(self.transport.read, 5)
File "/usr/local/python3/lib/python3.8/site-packages/thriftpy2/transport/__init__.py", line 14, in readall
chunk = read_fn(sz - have)
File "thriftpy2/transport/buffered/cybuffered.pyx", line 44, in thriftpy2.transport.buffered.cybuffered.TCyBufferedTransport.read
File "thriftpy2/transport/cybase.pyx", line 137, in thriftpy2.transport.cybase.CyTransportBase.get_string
File "thriftpy2/transport/buffered/cybuffered.pyx", line 65, in thriftpy2.transport.buffered.cybuffered.TCyBufferedTransport.c_read
File "thriftpy2/transport/buffered/cybuffered.pyx", line 69, in thriftpy2.transport.buffered.cybuffered.TCyBufferedTransport.read_trans
File "thriftpy2/transport/cybase.pyx", line 61, in thriftpy2.transport.cybase.TCyBuffer.read_trans
File "/usr/local/python3/lib/python3.8/site-packages/thriftpy2/transport/socket.py", line 110, in read
buff = self.sock.recv(sz)
socket.timeout: timed out
如果不用这个补丁，直接连接会怎样，这个结论是一样的。同样连接超时。
# _*_ coding:utf-8 _*_
import happybase
connection = happybase.Connection(host='bg2.test.com.cn',timeout=10000,autoconnect=False,protocol='binary')
connection.open()
print(connection.tables())#查看hbase现有的所有表名
connection.close()
查看tail -fn50 /appdata/home/hadoop/var/log/hbase/hbase-hbase-thrift-bg8.test.com.cn.log的日志，
2021-01-23 21:24:23,896 INFO [thrift-worker-28] client.RpcRetryingCallerImpl: Call exception, tries=22, retries=36, started=269589 ms ago, cancelled=false, msg=java.io.IOException: org.apache.zookeeper.KeeperException$NoNodeException: KeeperErrorCode = NoNode for /hbase/master, details=
2021-01-23 21:24:40,053 INFO [thrift-worker-29] client.RpcRetryingCallerImpl: Call exception, tries=17, retries=36, started=169031 ms ago, cancelled=false, msg=java.io.IOException: org.apache.zookeeper.KeeperException$NoNodeException: KeeperErrorCode = NoNode for /hbase/master, details=
查看zookeeper中，确实没有这个
[zk: localhost:2181(CONNECTED) 1] ls /hbase/master
Node does not exist: /hbase/master
注意更正Hbase.py中python2 的语法，except IOError, io:改成 except IOError as io:等和from .ttypes import *，参考ModuleNotFoundError: No module named ‘ttypes‘
# pip install hbase-python
pip install hbase-thrift
pip install protobuf
pip install kazoo
执行hbase hbck，命令查看到这个是直接切入到hbase用下面之后的效果。
2021-01-23 19:50:04,872 INFO [main] client.RpcRetryingCallerImpl: Call exception, tries=19, retries=36, started=209864 ms ago, cancelled=false, msg=org.apache.hadoop.hbase.exceptions.ConnectionClosedException: Connection closed, details=
2021-01-23 19:50:24,915 INFO [main] client.RpcRetryingCallerImpl: Call exception, tries=20, retries=36, started=229907 ms ago, cancelled=false, msg=org.apache.hadoop.hbase.exceptions.ConnectionClosedException: Connection closed, details=
2021-01-23 19:50:44,995 INFO [main] client.RpcRetryingCallerImpl: Call exception, tries=21, retries=36, started=249987 ms ago, cancelled=false, msg=org.apache.hadoop.hbase.exceptions.ConnectionClosedException: Connection closed, details=
2021-01-23 19:51:05,184 INFO [main] client.RpcRetryingCallerImpl: Call exception, tries=22, retries=36, started=270176 ms ago, cancelled=false, msg=org.apache.hadoop.hbase.exceptions.ConnectionClosedException: Connection closed, details=
2021-01-23 19:51:25,271 INFO [main] client.RpcRetryingCallerImpl: Call exception, tries=23, retries=36, started=290263 ms ago, cancelled=false, msg=org.apache.hadoop.hbase.exceptions.ConnectionClosedException: Connection closed, details=
接着我执行kinit -kt /etc/security/keytabs/hbase.headless.keytab hbase-test_data@HADOOP.COM，接着再执行hbase hbck，程序就可以往下走了。
Table KYLIN_QJPJY381BR is okay.
Number of regions: 1
Deployed on: bg5.test.com.cn,16020,1611387529866
0 inconsistencies detected.
Status: OK
通过python访问开启kerberos的hbase，解决方案参考开启kerberos后hbase连接
3 hdfs开启kerberos
参考踩坑记之—python3连接kerberos认证的hdfs
4 kylin 开启kerberos
参考【大数据安全】Apache Kylin 安全配置(Kerberos)
Kerberos server上创建kylin账号
kadmin.local
kadmin.local: addprinc kylin
kadmin.local: ktadd -norandkey -k /etc/security/keytabs/kylin.keytab kylin@HADOOP.COM
在kylin的机器上执行
useradd kylin
usermod -a -G hadoop kylin
chown -R kylin:hadoop kylin.keytab
4 zepplin开启kerberos
在kerberos主节点上执行，ambari不会自动创建，那样zepplin登录不进去，故执行下面的命令，同步过去就可以了。
scp hdfs.headless.keytab root@bg13.test.com.cn:/etc/security/keytabs
5 dbeaver与kerberos
使用DBeaver访问Kerberos环境下的Hive
先现在两个客户端软件，装好Kerberos
和DBeaver
5.1 kerberos
在kdc server上执行
kadmin.local
addprinc my_computer@HADOOP.COM
ktadd -norandkey -k /etc/security/keytabs/my_computer.keytab my_computer@HADOOP.COM
# 创建错了可以delete_principal my_computer@HADOOP.COM
非root用户下需要将生成的keytab文件，权限设置到644以上
在我的windows电脑上
配置环境变量
将kdc server中生成my_computer.keytab复制到本地，然后执行
对keytab进行初始化处理
kdestroy
kinit -kt C:\keytabs\my_computer.keytab my_computer@HADOOP.COM
klist
在windows上连接不上，应该是服务器上防火墙做了限制,88端口没有开放，88端口是kerberos身份验证和票证授予。开放之后，就ok了。
登录成功后，可以看到
5.2 dbeaver
在dbeaver.ini中添加配置
-Djavax.security.auth.useSubjectCredsOnly=false
-Djava.security.krb5.conf=C:\ProgramData\MIT\Kerberos5\krb5.ini
-Dsun.security.krb5.debug=true
URL模板应该按照下面的进行设置
jdbc:hive2://{host}[:{port}]/[{database}];principal=hive/{host}@HADOOP.COM
执行链接测试出现的问题：
Illegal char <"> at index 0: "C:\ProgramData\MIT\Kerberos5\krb5.ini"
那是因为使用DBeaver访问Kerberos环境下的Hive犯了个小错误,-Djava.security.krb5.conf=C:\ProgramData\MIT\Kerberos5\krb5.ini这样的配置才是对的。找到DBeaver链接kerberos安全认证的Phoenix集群找到了正确的解决方案。
不增加这个配置，则提示
Unexpected driver error occurred while connecting to the database
Can't get Kerberos realm
Can't get Kerberos realm
java.lang.reflect.InvocationTargetException
KrbException: Cannot locate default realm
Cannot locate default realm
参考windows下dbeaver客户端连接hive–kerberos认证方式,添加dbeaver与hive的配置
出现下面的问题，主要是下面的问题，这里借鉴了kerberos+sentry集成hive测试,因为端口后面少了/
jdbc:hive2://bg1.test.com.cn:10000/;principal=hive/bg1.test.com.cn@HADOOP.COM
导致出现hive Are you missing a '/' after the hostname ?的问题
5.3 ranger
按照上面的执行一般都没有什么问题，但是配置了ranger之后，就不一样了。如下面异常，虽然创建了kerberos用户访问权限，但是跟ranger结合之后，就有差异了。
SQL 错误 [40000] [42000]: Error while compiling statement: FAILED: HiveAccessControlException Permission denied: user [test04] does not have [CREATE] privilege on [default/school]
Error while compiling statement: FAILED: HiveAccessControlException Permission denied: user [test04] does not have [CREATE] privilege on [default/school]
Error while compiling statement: FAILED: HiveAccessControlException Permission denied: user [test04] does not have [CREATE] privilege on [default/school]
org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException:Permission denied: user [test04] does not have [CREATE] privilege on [default/school]
org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException:Permission denied: user [test04] does not have [CREATE] privilege on [default/school]
解决这个问题，只需要在ranger中分配权限就可以了
在ranger中创建用户,这里是一个internal用户，它不是从服务器上同步过来的。
给用户分配权限
接着，就可以在dbeaver中可以加载出表了。
按照前面配置权限，表可以读取出来，但是查询表里面的数据，就有问题了.
SQL 错误 [40000] [42000]: Error while compiling statement: FAILED: SemanticException Unable to fetch table student. java.security.AccessControlException: Permission denied: user=test01, access=EXECUTE, inode="/warehouse/tablespace/managed/hive":hive:hadoop:drwx------
at org.apache.hadoop.hdfs.server.namenode.FSPermissionChecker.check(FSPermissionChecker.java:399)
at org.apache.hadoop.hdfs.server.namenode.FSPermissionChecker.checkTraverse(FSPermissionChecker.java:315)
at org.apache.hadoop.hdfs.server.namenode.FSPermissionChecker.checkPermission(FSPermissionChecker.java:242)
at org.apache.ranger.authorization.hadoop.RangerHdfsAuthorizer$RangerAccessControlEnforcer.checkDefaultEnforcer(RangerHdfsAuthorizer.java:589)
在ranger中hdfs添加上这个用户的权限，就可以了。
这个时候，数据就查出来了。
选择其中一条数据，修改并保存报错，错误信息如下，这个问题比较头疼。
SQL 错误 [1] [08S01]: Error while processing statement: FAILED: Execution Error, return code 1 from org.apache.hadoop.hive.ql.exec.tez.TezTask
Error while processing statement: FAILED: Execution Error, return code 1 from org.apache.hadoop.hive.ql.exec.tez.TezTask
Error while processing statement: FAILED: Execution Error, return code 1 from org.apache.hadoop.hive.ql.exec.tez.TezTask
查看hiveserver2的日志,执行命令tail -fn50 /appdata/home/hadoop/var/log/hive/hiveserver2.log,这个里面才能看到完整的错误信息。看来真的原因test01用户没有提交queue的权限。
Caused by: org.apache.hadoop.ipc.RemoteException: org.apache.hadoop.security.AccessControlException: User test01 does not have permission to submit application_1611301884780_0087 to queue default
at org.apache.hadoop.yarn.ipc.RPCUtil.getRemoteException(RPCUtil.java:38)
at org.apache.hadoop.yarn.server.resourcemanager.RMAppManager.createAndPopulateNewRMApp(RMAppManager.java:427)
at org.apache.hadoop.yarn.server.resourcemanager.RMAppManager.submitApplication(RMAppManager.java:320)
at org.apache.hadoop.yarn.server.resourcemanager.ClientRMService.submitApplication(ClientRMService.java:645)
at org.apache.hadoop.yarn.api.impl.pb.service.ApplicationClientProtocolPBServiceImpl.submitApplication(ApplicationClientProtocolPBServiceImpl.java:277)
at org.apache.hadoop.yarn.proto.ApplicationClientProtocol$ApplicationClientProtocolService$2.callBlockingMethod(ApplicationClientProtocol.java:563)
at org.apache.hadoop.ipc.ProtobufRpcEngine$Server$ProtoBufRpcInvoker.call(ProtobufRpcEngine.java:524)
at org.apache.hadoop.ipc.RPC$Server.call(RPC.java:1025)
at org.apache.hadoop.ipc.Server$RpcCall.run(Server.java:876)
at org.apache.hadoop.ipc.Server$RpcCall.run(Server.java:822)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAs(Subject.java:422)
at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1730)
at org.apache.hadoop.ipc.Server$Handler.run(Server.java:2682)
Caused by: org.apache.hadoop.security.AccessControlException: User test01 does not have permission to submit application_1611301884780_0087 to queue default
at org.apache.hadoop.yarn.server.resourcemanager.RMAppManager.createAndPopulateNewRMApp(RMAppManager.java:429)
... 12 more
难道给test01在ranger中创建用户还是没有用，无法执行修改操作，只可以读或者写。
接着我在服务器上创建用户，同样在ranger上赋上权限。在所有的hadoop集群都添加此用户，添加一个节点并不能起到什么作用。
useradd test01
passwd test01
在每个节点添加用户之后，就不会出现下面的问题了。
TaskAttempt 3 failed, info=[Container container_e34_1611301884780_0091_01_000010 finished with diagnostics set to [Container failed, exitCode=-1000. [2021-01-24 21:07:17.742]Application application_1611301884780_0091 initialization failed (exitCode=255) with output: main : command provided 0
main : run as user is test01
main : requested yarn user is test01
User test01 not found
]]], Vertex did not succeed due to OWN_TASK_FAILURE
但是又出现新的问题，真是功夫都在细节里面，没有办法，做什么都不是那么顺利，只能说明自己的功夫不到家。
2021-01-24T21:16:05,290 ERROR [HiveServer2-Background-Pool: Thread-17373]: operation.Operation (:()) - Error running hive query:
org.apache.hive.service.cli.HiveSQLException: Error while processing statement: FAILED: Execution Error, return code 2 from org.apache.hadoop.hive.ql.exec.tez.TezTask. Vertex failed, vertexName=Map 1, vertexId=vertex_1611301884780_0092_1_00, diagnostics=[Task failed, taskId=task_1611301884780_0092_1_00_000001, diagnostics=[TaskAttempt 0 failed, info=[Error: Error while running task ( failure ) : attempt_1611301884780_0092_1_00_000001_0:java.lang.IllegalArgumentException: tez.runtime.io.sort.mb 3514 should be larger than 0 and should be less than the available task memory (MB):3276
at com.google.common.base.Preconditions.checkArgument(Preconditions.java:122)
at org.apache.tez.runtime.library.common.sort.impl.ExternalSorter.getInitialMemoryRequirement(ExternalSorter.java:360)
at org.apache.tez.runtime.library.output.OrderedPartitionedKVOutput.initialize(OrderedPartitionedKVOutput.java:97)
at org.apache.tez.runtime.LogicalIOProcessorRuntimeTask$InitializeOutputCallable._callInternal(LogicalIOProcessorRunt
上面的错误说的tez.runtime.io.sort.mb有些大了，先调整小为3000
想要干掉kerberos，怎么办呢？Ambari+HDP集群关闭kerberos认证后遇到的问题
扫一扫
1112
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
