[
https://issues.apache.org/jira/browse/HIVE-12160?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16849722#comment-16849722
]
David Mollitor commented on HIVE-12160:
---------------------------------------
I do not think the current patch is safe. I can set the keytab file and
principal name at runtime. This seems dangerous in itself and should probably
be opened in another ticket.
The best approach IMHO is for the HS2 to get a token from HBase and pass it to
the child process.
{code:sql}
set hive.server2.authentication.kerberos.keytab=/user/david.keytab;
set hive.server2.authentication.kerberos.keytab;
> hive.server2.authentication.kerberos.keytab=/user/david.keytab
{code}
> Hbase table query execution fails in secured cluster when
> hive.exec.mode.local.auto is set to true
> --------------------------------------------------------------------------------------------------
>
> Key: HIVE-12160
> URL: https://issues.apache.org/jira/browse/HIVE-12160
> Project: Hive
> Issue Type: Bug
> Components: Security
> Affects Versions: 1.1.0, 2.0.0
> Reporter: Aihua Xu
> Assignee: Aihua Xu
> Priority: Major
> Attachments: HIVE-12160.patch, HIVE-12160_trace.txt
>
>
> In a secured cluster with kerberos, a simple query like {{select count(*)
> from hbase_table;}} will fail with the following exception when
> hive.exec.mode.local.auto is set to true.
> {noformat}
> Error: Error while processing statement: FAILED: Execution Error, return code
> 134 from org.apache.hadoop.hive.ql.exec.mr.MapRedTask (state=08S01,code=134)
> {noformat}
> There is another scenario which may be caused by the same reason.
> Set hive.auto.convert.join to true, the join query {{select * from hbase_t1
> join hbase_t2 on hbase_t1.id = hbase_t2.id;}} also fails with the following
> exception:
> {noformat}
> Error while processing statement: FAILED: Execution Error, return code 2 from
> org.apache.hadoop.hive.ql.exec.mr.MapredLocalTask (state=08S01,code=2)
> {noformat}
> The failure seems to be caused by: during the compiliation, the main process
> doesn't need to access HBase, so HBase token is acquired, thus whem the
> process passes the tokens to child process, HBase token is not included. In
> MapredLocalTask, since the separate child process doesn't have HBase token so
> it fails.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
