Could this library be used with Hive Metastore Standalone with Kerberos support #139

richardwooding · 2021-04-08T11:42:54Z

richardwooding
Apr 8, 2021

Hive Metastore can be installed in a standalone fashion. Could this this library be used to connect to Hive Metastore Standalone, or does it expect the full Hive ecosystem. Additionally, in our configuration our server principal is a different value from our client principal, is it is possible to configure Kerberos authentication in this fashion.

i.e. our value for hive.metastore.kerberos.principal is different from the principal used with kinit.

We have this working in a JVM with org.apache.hive:hive-standalone-metastore:3.1.2 library, and we where wondering if we could do the same but in go.

Answered by beltran

Apr 8, 2021

Hello, unfortunately there's not a client for the hive metastore in this package. I'm not aware of any hive metastore libraries in go that also support kerberos but I guess there could be one out there. This is something I've wanted to do but haven't had the time yet. I may add it in the next weeks/months.

i.e. our value for hive.metastore.kerberos.principal is different from the principal used with kinit.

Then are you setting some values in the metastore property hadoop.proxyuser.hive.groups that allows the kinit user to impersonate the metastore user? If this is the case the metastore client shouldn't have to worry about the kinit user and the metastore user being different.

View full answer

beltran · 2021-04-08T12:40:06Z

beltran
Apr 8, 2021
Maintainer

Hello, unfortunately there's not a client for the hive metastore in this package. I'm not aware of any hive metastore libraries in go that also support kerberos but I guess there could be one out there. This is something I've wanted to do but haven't had the time yet. I may add it in the next weeks/months.

i.e. our value for hive.metastore.kerberos.principal is different from the principal used with kinit.

Then are you setting some values in the metastore property hadoop.proxyuser.hive.groups that allows the kinit user to impersonate the metastore user? If this is the case the metastore client shouldn't have to worry about the kinit user and the metastore user being different.

2 replies

richardwooding Apr 8, 2021
Author

Thank you for your swift response. I confirmed that we do indeed have specific settings in hadoop.proxyuser.hive.groups as well.

meoww-bot Dec 15, 2023

Hi, beltran , do u have plan to do a hive metastore client/libraries in Golang that support kerberos recently? I want to connect to kerberized hive metastore to do something like "get hdfs location of hive table" in Golang ways, and I saw "github.com/akolb1/gometastore/hmsclient" do not support kerberos ,but I had test it works well when connect to non-kerberized hive metastore... Besides, as far as I know, there's not other library can connect to hive metastore with kerberos supoort.

I saw the code , both gohive and gometastore are using the Apache official thrift go library "github.com/apache/thrift/lib/go/thrift", thrift is a framework used for RPC communication, I think it is not difficult to add kerberos support to gometastore, because hive metastore RPC communication with kerberos should be similar to gohive do, am I right?

beltran · 2023-12-16T03:10:58Z

beltran
Dec 16, 2023
Maintainer

I did try to get kerberos to work with the metastore client. See here. The whole branch is https://github.com/beltran/gohive/tree/metastore_client. It was working with non-kerberos auth. I couldn't get it work with kerberos.

I think it is not difficult to add kerberos support to gometastore, because hive metastore RPC communication with kerberos should be similar to gohive do, am I right?

This was my expectation as well. This was years ago, but I remember I was getting an error and simply didn't know how to proceed.

0 replies

beltran · 2023-12-16T04:14:46Z

beltran
Dec 16, 2023
Maintainer

hmm, I actually think it's working now https://github.com/beltran/gohive/tree/metastore_client. I added an example of how to use the metastore client with kerberos, it can be run with go run -tags "kerberos integration" example/main_meta.go. If you do run it please let me know if it works or you run into any issues.

I'll merge the PR in the next days once I clean it up.

5 replies

meoww-bot Dec 16, 2023

Thanks for your quick reply, I thought you would be very busy, so I planned to refer to your code to add kerberos support to gometastore on my own, but you have already done it! Thanks for your work!

Our kerberized hadoop in private net, so I need to build a binary to run. I did build by CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -tags "kerberos" -trimpath -o hmscli main.go, but got errors, I'm still trying to resolve it.

# github.com/beltran/gosasl
../../go/pkg/mod/github.com/beltran/[email protected]/gssapi.go:74:23: undefined: gssapi.Name
../../go/pkg/mod/github.com/beltran/[email protected]/gssapi.go:193:9: undefined: gssapi.Options
../../go/pkg/mod/github.com/beltran/[email protected]/gssapi.go:195:10: undefined: gssapi.Lib
../../go/pkg/mod/github.com/beltran/[email protected]/gssapi.go:199:25: undefined: gssapi.CredId
../../go/pkg/mod/github.com/beltran/[email protected]/gssapi.go:202:25: undefined: gssapi.CtxId
../../go/pkg/mod/github.com/beltran/[email protected]/gssapi.go:210:27: undefined: gssapi.GSS_C_INTEG_FLAG
../../go/pkg/mod/github.com/beltran/[email protected]/gssapi.go:210:61: undefined: gssapi.GSS_C_MUTUAL_FLAG
../../go/pkg/mod/github.com/beltran/[email protected]/gssapi.go:210:96: undefined: gssapi.GSS_C_SEQUENCE_FLAG
../../go/pkg/mod/github.com/beltran/[email protected]/gssapi.go:210:133: undefined: gssapi.GSS_C_CONF_FLAG
../../go/pkg/mod/github.com/beltran/[email protected]/gssapi.go:338:51: undefined: gssapi.Name
../../go/pkg/mod/github.com/beltran/[email protected]/gssapi.go:210:133: too many errors

beltran Dec 17, 2023
Maintainer

Happy to help, I've merged the PR, please see the docs: https://github.com/beltran/gohive?tab=readme-ov-file#connection-to-the-hive-metastore

meoww-bot Dec 17, 2023

There muse be some dependency issues on my MacOS, I cant install homebrew/dupes/heimdal when I ran brew install homebrew/dupes/heimdal, it shows Error: homebrew/dupes was deprecated. This tap is now empty and all its contents were either deleted or migrated.....

Then I try to build the binary on Linux vps with "kerberos" tags, ran the binary on the private net machine, it works!!! OMG! The environment : HDP 3.1.5,Hive 3.1.0

The following things are easy, let me complete the left functions of HiveMetastoreClient.

By the way, I have some questions, why we dont need to set Service Principle Name of kerberos? And is there any document( I did search by google but not found) about communication details about client connect to hiveserver2/hive metastore thrift + kerberos?

beltran Dec 18, 2023
Maintainer

The following things are easy, let me complete the left functions of HiveMetastoreClient.

That would be great!

why we dont need to set Service Principle Name of kerberos?

Not sure I follow, where would you set it? As long as kinit has been done, gohive will pick up everything it needs.

And is there any document( I did search by google but not found) about communication details about client connect to hiveserver2/hive metastore thrift + kerberos?

I don't think there are great docs. When I implemented this I went over the java library implementation and https://datatracker.ietf.org/doc/html/rfc4752 (GSSAPI), but I haven't checked for docs in a while.

meoww-bot Dec 18, 2023

Not sure I follow, where would you set it? As long as kinit has been done, gohive will pick up everything it needs.

Oh,I got it. Your gohive and gosasl are rely on kinit.I guess they read system krb5 cache to get kerberos auth. I used gopkg.in/jcmturner/gokrb5.v7 to create corresponding spnego client for scraping multiple hadoop jmx services，I need set SPN when create the spnego client, see here

I don't think there are great docs. When I implemented this I went over the java library implementation and https://datatracker.ietf.org/doc/html/rfc4752 (GSSAPI), but I haven't checked for docs in a while.

I have done something similar before, I don't want to install python package on the private net machine, so I went over the Python Apache Ranger library, and did a Go Client for Apache Ranger (still WIP). The rfc doc are always boring to read, maybe I will read it when I'm free. Thanks for the directions.

beltran · 2024-01-01T13:16:08Z

beltran
Jan 1, 2024
Maintainer

Closing the discussion since querying metastore is supported now.

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Could this library be used with Hive Metastore Standalone with Kerberos support #139

{{title}}

Replies: 4 comments 7 replies

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

Select a reply

Could this library be used with Hive Metastore Standalone with Kerberos support #139

richardwooding Apr 8, 2021

Replies: 4 comments · 7 replies

beltran Apr 8, 2021 Maintainer

richardwooding Apr 8, 2021 Author

meoww-bot Dec 15, 2023

beltran Dec 16, 2023 Maintainer

beltran Dec 16, 2023 Maintainer

meoww-bot Dec 16, 2023

beltran Dec 17, 2023 Maintainer

meoww-bot Dec 17, 2023

beltran Dec 18, 2023 Maintainer

meoww-bot Dec 18, 2023

beltran Jan 1, 2024 Maintainer

richardwooding
Apr 8, 2021

Replies: 4 comments 7 replies

beltran
Apr 8, 2021
Maintainer

richardwooding Apr 8, 2021
Author

beltran
Dec 16, 2023
Maintainer

beltran
Dec 16, 2023
Maintainer

beltran Dec 17, 2023
Maintainer

beltran Dec 18, 2023
Maintainer

beltran
Jan 1, 2024
Maintainer