Mailing-List: contact user-help@hive.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@hive.apache.org
MIME-Version: 1.0
From: Markovich <amrivkin@gmail.com>
Date: Thu, 20 Apr 2017 23:04:54 +0300
Message-ID: <CACpE_qFFZ20dkgq3-XrQmS8O5aBTcWD9d-CyAsBq71J-pvnP6w@mail.gmail.com>
Subject: User is not allowed to impersonate
To: user@hive.apache.org
Content-Type: multipart/alternative; boundary=001a114814a08dc4ac054d9ea713
archived-at: Thu, 20 Apr 2017 20:05:00 -0000

--001a114814a08dc4ac054d9ea713
Content-Type: text/plain; charset=UTF-8

Hi Hive users,

I've got a very strange problem and don't know where to go next, so
writting here, may be someone could help me.

I've got HDP 2.5 with Hive 1.2.1000.2.5.0.0-1245 and Hadoop
2.7.3.2.5.0.0-1245. I've got kerberos nad Ranger enabled.
I've installed HUE 3.11 on it, I'm getting erros like this: *Failed to
validate proxy privilege of hue for hdfs*, when logging into hue using user
hdfs.

I've already added* hadoop.proxyuser.hue.groups=** and
*hadoop.proxyuser.hue.hosts=** in core-site.xml. Checked that this settings
were applied:

# hadoop org.apache.hadoop.conf.Configuration | grep hue
<property><name>hadoop.proxyuser.hue.groups</name><value>*</value><source>core-site.xml</source></property>
<property><name>hadoop.proxyuser.hue.hosts</name><value>*</value><source>core-site.xml</source></property>

Also checked properties like:*hive.server2.enable.impersonation *and
*hive.server2.enable.doAs.*
I've logged into beeline and connected to Hive using hue ticket:

#klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: hue@DEMO.TEST

Valid starting       Expires              Service principal
04/20/2017 19:40:50  04/21/2017 19:40:50  krbtgt/DEMO.TEST@DEMO.TEST
        renew until 04/27/2017 19:40:50

#/usr/hdp/current/hive-client/bin/beeline --verbose
!connect
jdbc:hive2://drm2.demo.test:10001/default;principal=hive/drm2.demo.test@DEMO.TEST
;transportMode=http;httpPath=cliservice;hive.server2.proxy.user=hue

0: jdbc:hive2://drm2.demo.test:10001/defau> set
hive.server2.enable.impersonation;
Getting log thread is interrupted, since query is done!
+-----------------------------------------+--+
|                   set                   |
+-----------------------------------------+--+
| hive.server2.enable.impersonation=true  |
+-----------------------------------------+--+
1 row selected (0.144 seconds)

0: jdbc:hive2://drm2.demo.test:10001/defau> set hive.server2.enable.doAs;
Getting log thread is interrupted, since query is done!
+--------------------------------+--+
|              set               |
+--------------------------------+--+
| hive.server2.enable.doAs=true  |
+--------------------------------+--+
1 row selected (0.069 seconds)

When I'm trying to use hdfs as proxyuser through beeline, I've get:
Connecting to
jdbc:hive2://drm2.demo.test:10001/default;principal=hive/drm2.demo.test@DEMO.TEST
;transportMode=http;httpPath=cliservice;hive.server2.proxy.user=hdfs
Enter username for
jdbc:hive2://drm2.demo.test:10001/default;principal=hive/drm2.demo.test@DEMO.TEST
;transportMode=http;httpPath=cliservice;hive.server2.proxy.user=hdfs:
Enter password for
jdbc:hive2://drm2.demo.test:10001/default;principal=hive/drm2.demo.test@DEMO.TEST
;transportMode=http;httpPath=cliservice;hive.server2.proxy.user=hdfs:
Error: Failed to validate proxy privilege of hue for hdfs
(state=08S01,code=0)
org.apache.hive.service.cli.HiveSQLException: Failed to validate proxy
privilege of hue for hdfs
...
Caused by: org.apache.hive.service.cli.HiveSQLException: Failed to validate
proxy privilege of hue for hdfs
...
Caused by: org.apache.hadoop.security.authorize.AuthorizationException:
User: hue is not allowed to impersonate hdfs

I've looked in Hadoop sources and this error means problem with
hadoop.proxyuser.hue.groups.
So at some very strange reasone hadoop is unable to allow user Hue to
impersonate hdfs or any other user.

Where should I dig next? I'm a bit confused.

Also yarn, hive, hdfs and hcat - all this users can impersonate any user,
so impersonation is working.
I've also checked if hadoop mapping to local is correct, and it seems to be
correct:
# hadoop org.apache.hadoop.security.HadoopKerberosName hue@DEMO.TEST
Name: hue@DEMO.TEST to hue

Any ideas or help is welcome. I've stuck with this problem for 2 days
already.

Regards,
Markovich

--001a114814a08dc4ac054d9ea713
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi Hive users,<div><br></div><div>I&#39;ve got a very stra=
nge problem and don&#39;t know where to go next, so writting here, may be s=
omeone could help me.</div><div><br></div><div>I&#39;ve got HDP 2.5 with Hi=
ve 1.2.1000.2.5.0.0-1245=C2=A0and Hadoop 2.7.3.2.5.0.0-1245. I&#39;ve got k=
erberos nad Ranger enabled.</div><div>I&#39;ve installed HUE 3.11 on it, I&=
#39;m getting erros like this:=C2=A0<b>Failed to validate proxy privilege o=
f hue for hdfs</b>, when logging into hue using user hdfs.</div><div><br></=
div><div>I&#39;ve already added<b> hadoop.proxyuser.hue.groups=3D*</b> and =
<b>hadoop.proxyuser.hue.hosts=3D*</b> in core-site.xml. Checked that this s=
ettings were applied:</div><div><br></div><div><div># hadoop org.apache.had=
oop.conf.Configuration | grep hue</div><div>&lt;property&gt;&lt;name&gt;had=
oop.proxyuser.hue.groups&lt;/name&gt;&lt;value&gt;*&lt;/value&gt;&lt;source=
&gt;core-site.xml&lt;/source&gt;&lt;/property&gt;</div><div>&lt;property&gt=
;&lt;name&gt;hadoop.proxyuser.hue.hosts&lt;/name&gt;&lt;value&gt;*&lt;/valu=
e&gt;&lt;source&gt;core-site.xml&lt;/source&gt;&lt;/property&gt;</div></div=
><div><br></div><div>Also checked properties like:<b>hive.server2.enable.im=
personation </b>and=C2=A0<b>hive.server2.enable.doAs.</b></div><div>I&#39;v=
e logged into beeline and connected to Hive using hue ticket:</div><div><br=
></div><div><div>#klist</div><div>Ticket cache: FILE:/tmp/krb5cc_0</div><di=
v>Default principal: hue@DEMO.TEST</div><div><br></div><div>Valid starting =
=C2=A0 =C2=A0 =C2=A0 Expires =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0Service principal</div><div>04/20/2017 19:40:50 =C2=A004/21/2017 19:40:5=
0 =C2=A0krbtgt/DEMO.TEST@DEMO.TEST</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 re=
new until 04/27/2017 19:40:50</div></div><div><br></div><div>#/usr/hdp/curr=
ent/hive-client/bin/beeline --verbose</div><div>!connect jdbc:hive2://drm2.=
demo.test:10001/default;principal=3Dhive/drm2.demo.test@DEMO.TEST;transport=
Mode=3Dhttp;httpPath=3Dcliservice;hive.server2.proxy.user=3Dhue<br></div><d=
iv><br></div><div><div>0: jdbc:hive2://drm2.demo.test:10001/defau&gt; set h=
ive.server2.enable.impersonation;</div><div>Getting log thread is interrupt=
ed, since query is done!</div><div>+---------------------------------------=
--+--+</div><div>| =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 set =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 |=
</div><div>+-----------------------------------------+--+</div><div>| hive.=
server2.enable.impersonation=3Dtrue =C2=A0|</div><div>+--------------------=
---------------------+--+</div><div>1 row selected (0.144 seconds)</div></d=
iv><div><br></div><div><div>0: jdbc:hive2://drm2.demo.test:10001/defau&gt; =
set hive.server2.enable.doAs;</div><div>Getting log thread is interrupted, =
since query is done!</div><div>+--------------------------------+--+</div><=
div>| =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0set =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 |</div><div>+------------------------------=
--+--+</div><div>| hive.server2.enable.doAs=3Dtrue =C2=A0|</div><div>+-----=
---------------------------+--+</div><div>1 row selected (0.069 seconds)</d=
iv></div><div><br></div><div>When I&#39;m trying to use hdfs as proxyuser t=
hrough beeline, I&#39;ve get:</div><div><div>Connecting to jdbc:hive2://drm=
2.demo.test:10001/default;principal=3Dhive/drm2.demo.test@DEMO.TEST;transpo=
rtMode=3Dhttp;httpPath=3Dcliservice;hive.server2.proxy.user=3Dhdfs</div><di=
v>Enter username for jdbc:hive2://drm2.demo.test:10001/default;principal=3D=
hive/drm2.demo.test@DEMO.TEST;transportMode=3Dhttp;httpPath=3Dcliservice;hi=
ve.server2.proxy.user=3Dhdfs:</div><div>Enter password for jdbc:hive2://drm=
2.demo.test:10001/default;principal=3Dhive/drm2.demo.test@DEMO.TEST;transpo=
rtMode=3Dhttp;httpPath=3Dcliservice;hive.server2.proxy.user=3Dhdfs:</div><d=
iv>Error: Failed to validate proxy privilege of hue for hdfs (state=3D08S01=
,code=3D0)</div><div>org.apache.hive.service.cli.HiveSQLException: Failed t=
o validate proxy privilege of hue for hdfs</div></div><div>...</div><div><d=
iv>Caused by: org.apache.hive.service.cli.HiveSQLException: Failed to valid=
ate proxy privilege of hue for hdfs</div></div><div>...</div><div><div>Caus=
ed by: org.apache.hadoop.security.authorize.AuthorizationException: User: h=
ue is not allowed to impersonate hdfs</div></div><div><br></div><div>I&#39;=
ve looked in Hadoop sources and this error means problem with hadoop.proxyu=
ser.hue.groups.=C2=A0</div><div>So at some very strange reasone hadoop is u=
nable to allow user Hue to impersonate hdfs or any other user.</div><div><b=
r></div><div>Where should I dig next? I&#39;m a bit confused.</div><div><br=
></div><div>Also yarn, hive, hdfs and hcat - all this users can impersonate=
 any user, so impersonation is working.</div><div>I&#39;ve also checked if =
hadoop mapping to local is correct, and it seems to be correct:</div><div><=
div># hadoop org.apache.hadoop.security.HadoopKerberosName hue@DEMO.TEST</d=
iv><div>Name: hue@DEMO.TEST to hue</div></div><div><br></div><div>Any ideas=
 or help is welcome. I&#39;ve stuck with this problem for 2 days already.</=
div><div><br></div><div>Regards,</div><div>Markovich</div><div><br></div><d=
iv><br></div><div><br></div><div><br></div><div><br></div><div><br></div><d=
iv><br></div><div><br></div><div><br></div><div><br></div></div>

--001a114814a08dc4ac054d9ea713--