AuthorizationException Użytkownik nie wolno podszywać Użytkownika

Question

Napisałem pracę iskra, która rejestruje temp tabeli i kiedy wystawiać go przez Beeline (klient JDBC)

$ ./bin/beeline 
beeline> !connect jdbc:hive2://IP:10003 -n ram -p xxxx 
0: jdbc:hive2://IP> show tables; 
+---------------------------------------------+--------------+---------------------+ 
|     tableName       | isTemporary | 
+---------------------------------------------+--------------+---------------------+ 
| f238              | true    | 
+---------------------------------------------+--------------+---------------------+ 
2 rows selected (0.309 seconds) 
0: jdbc:hive2://IP> 

mogę obejrzeć tabelę. Podczas odpytywania dostaję ten komunikat o błędzie

0: jdbc:hive2://IP> select * from f238; 
Error: org.apache.hadoop.ipc.RemoteException(org.apache.hadoop.security.authorize.AuthorizationException): User: ram is not allowed to impersonate ram (state=,code=0) 
0: jdbc:hive2://IP> 

mam to w ula-site.xml,

<property> 
    <name>hive.metastore.sasl.enabled</name> 
    <value>false</value> 
    <description>If true, the metastore Thrift interface will be secured with SASL. Clients must authenticate with Kerberos.</description> 
</property> 

<property> 
    <name>hive.server2.enable.doAs</name> 
    <value>false</value> 
</property> 

<property> 
    <name>hive.server2.authentication</name> 
    <value>NONE</value> 
</property> 

mam to w podstawowej site.xml,

<property> 
    <name>hadoop.proxyuser.hive.groups</name> 
    <value>*</value> 
</property> 

<property> 
    <name>hadoop.proxyuser.hive.hosts</name> 
    <value>*</value> 
</property> 

pełny raport

ERROR [pool-19-thread-2] thriftserver.SparkExecuteStatementOperation: Error running hive query: 
org.apache.hive.service.cli.HiveSQLException: org.apache.hadoop.ipc.RemoteException(org.apache.hadoop.security.authorize.AuthorizationException): User: ram is not allowed to impersonate ram 
     at org.apache.spark.sql.hive.thriftserver.SparkExecuteStatementOperation.runInternal(SparkExecuteStatementOperation.scala:259) 
     at org.apache.spark.sql.hive.thriftserver.SparkExecuteStatementOperation$$anon$1$$anon$2.run(SparkExecuteStatementOperation.scala:171) 
     at java.security.AccessController.doPrivileged(Native Method) 
     at javax.security.auth.Subject.doAs(Subject.java:422) 
     at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1657) 
     at org.apache.spark.sql.hive.thriftserver.SparkExecuteStatementOperation$$anon$1.run(SparkExecuteStatementOperation.scala:182) 
     at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) 
     at java.util.concurrent.FutureTask.run(FutureTask.java:266) 
     at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) 
     at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) 
     at java.lang.Thread.run(Thread.java:745) 

Każdy pomysł, jaki konfigurat jon, którego mi brakuje?

Answer 1

<property> 
<name>hive.server2.enable.doAs</name> 
<value>true</value> 
</property> 

Także jeśli chcesz użytkownik ABC personifikować wszystko (*), dodaj poniżej właściwości do swojej podstawowej site.xml

<property> 
    <name>hadoop.proxyuser.ABC.groups</name> 
<value>*</value> 
</property> 

<property> 
<name>hadoop.proxyuser.ABC.hosts</name> 
<value>*</value> 
</property>