Uploaded image for project: 'Hive'
  1. Hive
  2. HIVE-20922

HiveServer2 user is switched to another occasionally

    XMLWordPrintableJSON

    Details

    • Type: Bug
    • Status: Open
    • Priority: Major
    • Resolution: Unresolved
    • Affects Version/s: 1.2.1
    • Fix Version/s: None
    • Component/s: Authentication
    • Labels:
      None
    • Environment:

      HiveServer2 version: 1.2.1

      Hive and yarn were deployed in same machine.

      Description

      The HiveServer2(version 1.2.1)authentication configuration is:
      authentication type: kerberos
      kerberos principal: hive/host@DC1.FH.COM

      Other infomation:
      client principal: nbhd@DC1.FH.COM
      yarn service principal:yarn/_HOST@DC1.FH.COM

      After the hive service was started, application could use jdbc to access hive service. But sometime later, clients got the exception. The user of the hive service was switched to another one (yarn).

      In my environment, Hive and Yarn were deployed in same machine, the user of yarn service is yarn/_HOST@DC1.FH.COM. Before the exception occured, the hive service was not restarted.

      ==============================================================

      Main logs:

      2018-11-11 23:59:35 [HiveServer2-Handler-Pool: Thread-115739] INFO org.apache.hive.service.cli.thrift.ThriftCLIService.OpenSession(294) -Client protocol version: HIVE_CLI_SERVICE_PROTOCOL_V8
      2018-11-11 23:59:35 [HiveServer2-Handler-Pool: Thread-115739] WARN org.apache.hive.service.cli.thrift.ThriftCLIService.OpenSession(308) -Error opening session:
      org.apache.hive.service.cli.HiveSQLException: Failed to open new session: java.lang.RuntimeException: java.lang.RuntimeException: org.apache.hadoop.ipc.RemoteException(org.apache.hadoop.security.authorize.AuthorizationException): User: yarn/master@DC1.FH.COM is not allowed to impersonate nbhd
      at org.apache.hive.service.cli.session.SessionManager.openSession(SessionManager.java:266)
      at org.apache.hive.service.cli.CLIService.openSessionWithImpersonation(CLIService.java:202)
      at org.apache.hive.service.cli.thrift.ThriftCLIService.getSessionHandle(ThriftCLIService.java:402)
      at org.apache.hive.service.cli.thrift.ThriftCLIService.OpenSession(ThriftCLIService.java:297)
      at org.apache.hive.service.cli.thrift.TCLIService$Processor$OpenSession.getResult(TCLIService.java:1253)
      at org.apache.hive.service.cli.thrift.TCLIService$Processor$OpenSession.getResult(TCLIService.java:1238)
      at org.apache.thrift.ProcessFunction.process(ProcessFunction.java:39)
      at org.apache.thrift.TBaseProcessor.process(TBaseProcessor.java:39)
      at org.apache.hadoop.hive.thrift.HadoopThriftAuthBridge$Server$TUGIAssumingProcessor.process(HadoopThriftAuthBridge.java:692)
      at org.apache.thrift.server.TThreadPoolServer$WorkerProcess.run(TThreadPoolServer.java:285)
      at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
      at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
      at java.lang.Thread.run(Thread.java:745)
      Caused by: java.lang.RuntimeException: java.lang.RuntimeException: org.apache.hadoop.ipc.RemoteException(org.apache.hadoop.security.authorize.AuthorizationException): User: yarn/master@DC1.FH.COM is not allowed to impersonate nbhd
      at org.apache.hive.service.cli.session.HiveSessionProxy.invoke(HiveSessionProxy.java:83)
      at org.apache.hive.service.cli.session.HiveSessionProxy.access$000(HiveSessionProxy.java:36)
      at org.apache.hive.service.cli.session.HiveSessionProxy$1.run(HiveSessionProxy.java:63)
      at java.security.AccessController.doPrivileged(Native Method)
      at javax.security.auth.Subject.doAs(Subject.java:415)
      at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1628)
      at org.apache.hive.service.cli.session.HiveSessionProxy.invoke(HiveSessionProxy.java:59)
      at com.sun.proxy.$Proxy19.open(Unknown Source)
      at org.apache.hive.service.cli.session.SessionManager.openSession(SessionManager.java:258)
      ... 12 more
      Caused by: java.lang.RuntimeException: org.apache.hadoop.ipc.RemoteException(org.apache.hadoop.security.authorize.AuthorizationException): User: yarn/master@DC1.FH.COM is not allowed to impersonate nbhd
      at org.apache.hadoop.hive.ql.session.SessionState.start(SessionState.java:522)
      at org.apache.hive.service.cli.session.HiveSessionImpl.open(HiveSessionImpl.java:137)
      at sun.reflect.GeneratedMethodAccessor22.invoke(Unknown Source)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
      at java.lang.reflect.Method.invoke(Method.java:606)
      at org.apache.hive.service.cli.session.HiveSessionProxy.invoke(HiveSessionProxy.java:78)
      ... 20 more
      Caused by: org.apache.hadoop.ipc.RemoteException(org.apache.hadoop.security.authorize.AuthorizationException): User: yarn/master@DC1.FH.COM is not allowed to impersonate nbhd
      at org.apache.hadoop.ipc.Client.call(Client.java:1468)
      at org.apache.hadoop.ipc.Client.call(Client.java:1399)
      at org.apache.hadoop.ipc.ProtobufRpcEngine$Invoker.invoke(ProtobufRpcEngine.java:232)
      at com.sun.proxy.$Proxy14.getFileInfo(Unknown Source)
      at org.apache.hadoop.hdfs.protocolPB.ClientNamenodeProtocolTranslatorPB.getFileInfo(ClientNamenodeProtocolTranslatorPB.java:752)
      at sun.reflect.GeneratedMethodAccessor7.invoke(Unknown Source)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
      at java.lang.reflect.Method.invoke(Method.java:606)
      at org.apache.hadoop.io.retry.RetryInvocationHandler.invokeMethod(RetryInvocationHandler.java:187)
      at org.apache.hadoop.io.retry.RetryInvocationHandler.invoke(RetryInvocationHandler.java:102)
      at com.sun.proxy.$Proxy15.getFileInfo(Unknown Source)
      at org.apache.hadoop.hdfs.DFSClient.getFileInfo(DFSClient.java:1988)
      at org.apache.hadoop.hdfs.DistributedFileSystem$18.doCall(DistributedFileSystem.java:1118)
      at org.apache.hadoop.hdfs.DistributedFileSystem$18.doCall(DistributedFileSystem.java:1114)
      at org.apache.hadoop.fs.FileSystemLinkResolver.resolve(FileSystemLinkResolver.java:81)
      at org.apache.hadoop.hdfs.DistributedFileSystem.getFileStatus(DistributedFileSystem.java:1114)
      at org.apache.hadoop.fs.FileSystem.exists(FileSystem.java:1400)
      at org.apache.hadoop.hive.ql.session.SessionState.createRootHDFSDir(SessionState.java:596)
      at org.apache.hadoop.hive.ql.session.SessionState.createSessionDirs(SessionState.java:554)
      at org.apache.hadoop.hive.ql.session.SessionState.start(SessionState.java:508)
      ... 25 more
      2018-11-11 23:59:40 [HiveServer2-Handler-Pool: Thread-115741] INFO org.apache.hive.service.cli.thrift.ThriftCLIService.OpenSession(294) -Client protocol version: HIVE_CLI_SERVICE_PROTOCOL_V8
      2018-11-11 23:59:40 [HiveServer2-Handler-Pool: Thread-115741] WARN org.apache.hive.service.cli.thrift.ThriftCLIService.OpenSession(308) -Error opening session:
      org.apache.hive.service.cli.HiveSQLException: Failed to open new session: java.lang.RuntimeException: java.lang.RuntimeException: org.apache.hadoop.ipc.RemoteException(org.apache.hadoop.security.authorize.AuthorizationException): User: yarn/master@DC1.FH.COM is not allowed to impersonate nbhd
      at org.apache.hive.service.cli.session.SessionManager.openSession(SessionManager.java:266)
      at org.apache.hive.service.cli.CLIService.openSessionWithImpersonation(CLIService.java:202)
      at org.apache.hive.service.cli.thrift.ThriftCLIService.getSessionHandle(ThriftCLIService.java:402)
      at org.apache.hive.service.cli.thrift.ThriftCLIService.OpenSession(ThriftCLIService.java:297)
      at org.apache.hive.service.cli.thrift.TCLIService$Processor$OpenSession.getResult(TCLIService.java:1253)
      at org.apache.hive.service.cli.thrift.TCLIService$Processor$OpenSession.getResult(TCLIService.java:1238)
      at org.apache.thrift.ProcessFunction.process(ProcessFunction.java:39)
      at org.apache.thrift.TBaseProcessor.process(TBaseProcessor.java:39)
      at org.apache.hadoop.hive.thrift.HadoopThriftAuthBridge$Server$TUGIAssumingProcessor.process(HadoopThriftAuthBridge.java:692)
      at org.apache.thrift.server.TThreadPoolServer$WorkerProcess.run(TThreadPoolServer.java:285)
      at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
      at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
      at java.lang.Thread.run(Thread.java:745)
      Caused by: java.lang.RuntimeException: java.lang.RuntimeException: org.apache.hadoop.ipc.RemoteException(org.apache.hadoop.security.authorize.AuthorizationException): User: yarn/master@DC1.FH.COM is not allowed to impersonate nbhd
      at org.apache.hive.service.cli.session.HiveSessionProxy.invoke(HiveSessionProxy.java:83)
      at org.apache.hive.service.cli.session.HiveSessionProxy.access$000(HiveSessionProxy.java:36)
      at org.apache.hive.service.cli.session.HiveSessionProxy$1.run(HiveSessionProxy.java:63)
      at java.security.AccessController.doPrivileged(Native Method)
      at javax.security.auth.Subject.doAs(Subject.java:415)
      at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1628)
      at org.apache.hive.service.cli.session.HiveSessionProxy.invoke(HiveSessionProxy.java:59)
      at com.sun.proxy.$Proxy19.open(Unknown Source)
      at org.apache.hive.service.cli.session.SessionManager.openSession(SessionManager.java:258)
      ... 12 more
      Caused by: java.lang.RuntimeException: org.apache.hadoop.ipc.RemoteException(org.apache.hadoop.security.authorize.AuthorizationException): User: yarn/master@DC1.FH.COM is not allowed to impersonate nbhd
      at org.apache.hadoop.hive.ql.session.SessionState.start(SessionState.java:522)
      at org.apache.hive.service.cli.session.HiveSessionImpl.open(HiveSessionImpl.java:137)
      at sun.reflect.GeneratedMethodAccessor22.invoke(Unknown Source)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
      at java.lang.reflect.Method.invoke(Method.java:606)
      at org.apache.hive.service.cli.session.HiveSessionProxy.invoke(HiveSessionProxy.java:78)
      ... 20 more
      Caused by: org.apache.hadoop.ipc.RemoteException(org.apache.hadoop.security.authorize.AuthorizationException): User: yarn/master@DC1.FH.COM is not allowed to impersonate nbhd
      at org.apache.hadoop.ipc.Client.call(Client.java:1468)
      at org.apache.hadoop.ipc.Client.call(Client.java:1399)
      at org.apache.hadoop.ipc.ProtobufRpcEngine$Invoker.invoke(ProtobufRpcEngine.java:232)
      at com.sun.proxy.$Proxy14.getFileInfo(Unknown Source)
      at org.apache.hadoop.hdfs.protocolPB.ClientNamenodeProtocolTranslatorPB.getFileInfo(ClientNamenodeProtocolTranslatorPB.java:752)
      at sun.reflect.GeneratedMethodAccessor7.invoke(Unknown Source)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
      at java.lang.reflect.Method.invoke(Method.java:606)
      at org.apache.hadoop.io.retry.RetryInvocationHandler.invokeMethod(RetryInvocationHandler.java:187)
      at org.apache.hadoop.io.retry.RetryInvocationHandler.invoke(RetryInvocationHandler.java:102)
      at com.sun.proxy.$Proxy15.getFileInfo(Unknown Source)
      at org.apache.hadoop.hdfs.DFSClient.getFileInfo(DFSClient.java:1988)
      at org.apache.hadoop.hdfs.DistributedFileSystem$18.doCall(DistributedFileSystem.java:1118)
      at org.apache.hadoop.hdfs.DistributedFileSystem$18.doCall(DistributedFileSystem.java:1114)
      at org.apache.hadoop.fs.FileSystemLinkResolver.resolve(FileSystemLinkResolver.java:81)
      at org.apache.hadoop.hdfs.DistributedFileSystem.getFileStatus(DistributedFileSystem.java:1114)
      at org.apache.hadoop.fs.FileSystem.exists(FileSystem.java:1400)
      at org.apache.hadoop.hive.ql.session.SessionState.createRootHDFSDir(SessionState.java:596)
      at org.apache.hadoop.hive.ql.session.SessionState.createSessionDirs(SessionState.java:554)
      at org.apache.hadoop.hive.ql.session.SessionState.start(SessionState.java:508)
      ... 25 more
      2018-11-11 23:59:45 [HiveServer2-Handler-Pool: Thread-115743] INFO org.apache.hive.service.cli.thrift.ThriftCLIService.OpenSession(294) -Client protocol version: HIVE_CLI_SERVICE_PROTOCOL_V8

       

        Attachments

          Activity

            People

            • Assignee:
              Unassigned
              Reporter:
              caojunliang-6@163.com Cao Junliang
            • Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

              • Created:
                Updated: