Error initialized or created transport for authentication

I am trying to connect to Hive database with Oracle SQL developer using Cloudera Hive JDBC drivers.

I keep getting following error message

Status : Failure -Test failed: [Cloudera][HiveJDBCDriver](500164) Error initialized or created transport for authentication: [Cloudera][HiveJDBCDriver](500169) Unable to connect to server: GSS initiate failed.

My Hadoop environment has

• Hive version 1.2.1.2.3
• Kerberos version 1.10.3-10

I am trying to connect to this Hive database from Windows 7 64-bit machine which has

• Sqldeveloper version 4.2.0.16.356.1154
• Cloudera_Hive JDBC4 driver 2.5.18.1050
• MIT Kerberos app version 4.1

Important: Windows machine I am connecting from is on a different domain as that of Hadoop cluster.

I have followed instructions from Using SQL Developer to access Apache Hive with kerberos authentication and steps I have performed are.

1. Imported all the jar files to SQL Developer from the JDBC driver .
2. Updated Java Crypto jars (local_policy.jar and US_export_policy.jap in sqldeveloperjdkjrelibsecurity folder) with ones provided in UnlimitedJCEPolicy.zip.
3. Created an environment variable  KRB5CCNAME whose value is set to C:sqldeveloperktfile.keytab
4. Installed MIT kerberos 4.1 64-bit app
5. Acquired valid ticked (via kinit/hrough the app)
6. Picture below shows the connection details

Hive connection details were:

Host name: machine.test.group
port: 10010
database: default

Krbservicename: hive
AuthMech: 1
KrbFQDN: machine.test.group
KrbRealm:  dev.mycompany.com

Can someone please advise me what I can do to fix the issue and connect to Hive using JDBC drivers.

I am trying to connect to Hive2 server via JDBC with kerberos authentication. After numerous attempts to make it work, I can’t get it to work with the Cloudera driver.

If someone can help me to solve the problem, I can greatly appreciate it.

I have this method:

    private Connection establishConnection() {
    final String driverPropertyClassName = "driver";
    final String urlProperty = "url";
    Properties hiveProperties = config.getMatchingProperties("hive.jdbc");
    String driverClassName = (String) hiveProperties.remove(driverPropertyClassName);
    String url = (String) hiveProperties.remove(urlProperty);
    Configuration hadoopConfig = new Configuration();
    hadoopConfig.set("hadoop.security.authentication", "Kerberos");
    String p = config.getProperty("hadoop.core.site.path");
    Path path = new Path(p);
    hadoopConfig.addResource(path);
    UserGroupInformation.setConfiguration(hadoopConfig);

    Connection conn = null;
    if (driverClassName != null) {
        try {
            UserGroupInformation.loginUserFromKeytab(config.getProperty("login.user"), config.getProperty("keytab.file"));
            Driver driver = (Driver) Class.forName(driverClassName).newInstance();
            DriverManager.registerDriver(driver);
            conn = DriverManager.getConnection(url, hiveProperties);
        } catch (Throwable e) {
            LOG.error("Failed to establish Hive connection", e);
        }
    }
    return conn;
}

URL for the server, that I am getting from the properties in the format described in Cloudera documentation

I am getting an exception:

2018-05-05 18:26:49 ERROR HiveReader:147 - Failed to establish Hive connection
java.sql.SQLException: [Cloudera][HiveJDBCDriver](500164) Error initialized or created transport for authentication: Peer indicated failure: Unsupported mechanism type PLAIN.
    at com.cloudera.hiveserver2.hivecommon.api.HiveServer2ClientFactory.createTransport(Unknown Source)
    at com.cloudera.hiveserver2.hivecommon.api.ZooKeeperEnabledExtendedHS2Factory.createClient(Unknown Source)
...

I thought, that it is missing AuthMech attribute and added AuthMech=1 to the URL. Now I am getting:

java.sql.SQLNonTransientConnectionException: [Cloudera][JDBC](10100) Connection Refused: [Cloudera][JDBC](11640) Required Connection Key(s): KrbHostFQDN, KrbServiceName; [Cloudera][JDBC](11480) Optional Connection Key(s): AsyncExecPollInterval, AutomaticColumnRename, CatalogSchemaSwitch, DecimalColumnScale, DefaultStringColumnLength, DelegationToken, DelegationUID, krbAuthType, KrbRealm, PreparedMetaLimitZero, RowsFetchedPerBlock, SocketTimeOut, ssl, StripCatalogName, transportMode, UseCustomTypeCoercionMap, UseNativeQuery, zk
    at com.cloudera.hiveserver2.exceptions.ExceptionConverter.toSQLException(Unknown Source)
    at com.cloudera.hiveserver2.jdbc.common.BaseConnectionFactory.checkResponseMap(Unknown Source)
    ...

But KrbHostFQDN is already specified in the principal property as required in the documentation.

Am I missing something or is this documentation wrong?

[{«Product»:{«code»:»SSEP7J»,»label»:»Cognos Business Intelligence»},»Business Unit»:{«code»:»BU059″,»label»:»IBM Software w/o TPS»},»Component»:»Cognos Administration»,»Platform»:[{«code»:»PF016″,»label»:»Linux»},{«code»:»PF033″,»label»:»Windows»}],»Version»:»10.2.2″,»Edition»:»»,»Line of Business»:{«code»:»LOB10″,»label»:»Data and AI»}}]

We wish to integrate our Business Objects Environment to Kerberos-Enabled Hive Database.

Environment Details:

Version: SAP BIP 4.2 SP03 Patch 05

OS: RHEL

Clustered Environment with 4 processing Tiers

Authentication : SAP & Enterprise.

When we create a connection in IDT, it fails with below error:

[Simba][HiveJDBCDriver](500164) Error initialized or created transport for authentication: Peer indicated failure: Unsupported mechanism type PLAIN.

When ‘AuthMech=1’ is added to JDBC Driver Properties, the error changes to:

I am not sure if SPN or other configurations are needed to be setup on BO Server, We are not using SSO.

Any help would be appreciated.

Thanks and Regards,

Aakash Gupta

After much trial and error and time spent we’ve been able to use the following to get it to work. Hopefully this will help someone else.

Things needed for Splunk DB Connect on Windows to work with a Hive 2 Kerberos connection:

• Kerberos MIT — https://web.mit.edu/kerberos/dist/ (kfw-4.0.1-amd64)
• Cloudera JDBC driver — https://www.cloudera.com/downloads/connectors/hive/jdbc/2-6-5.html (HiveJDBC41.jar)
• OpenJDK 8 — https://jdk.java.net/java-se-ri/8-MR3

Other things to mention:

Oracle’s Java 8 did not work for us. 

Krb5.conf configuration files placed in %JAVA_HOME%jrelibsecurity directory didn’t seem to help DB Connect when verifying the connection.

We tested successfully on Windows servers with Splunk v8.2/DB Connect v3.5.1 and Splunk v7.3/DB Connect 3.3.1.

db_connection_types.conf file needs to exist or be created in the DB Connect local directory with a config that looks like this for the Cloudera driver…

[cloudera_hive_2]
displayName = Cloudera Hive 2
serviceClass = com.splunk.dbx2.DefaultDBX2JDBC
jdbcDriverClass = com.cloudera.hive.jdbc41.HS2Driver
jdbcUrlFormat = jdbc:hive2://<host>:<port>/<database>
port = 20500
ui_default_catalog = $database$

The more up-to-date versions of DB Connect are more verbose with any errors generated.

If I were to start the process again I would install the newest version of DB Connect compatible with existing version of Splunk. Download OpenJDK v8, extract and copy it into a directory (C:Program FilesJavajava-se-8u41-ri). Then create a JAVA_HOME system environment variable and place that directory inside as the value. Reboot the server. You may then need to manually update the «JRE Installation Path» field in DB Connects Configuration -> Settings -> General tab and Save. Then reboot Splunk web via Settings -> Server Controls. Once there are no more errors popping up, download the Cloudera driver and move it into the DB Connect «drivers» directory (splunk_app_db_connectdrivers). Go to the Configuration -> Settings -> Drivers tab and click reload. The driver should now exist on the page and have a green check mark next to it along with the version. Install Kerberos MIT. Create a connection in DB Connect and setup a connection string in the «JDBC URL» field with something like…

jdbc:hive2://dbserverhostname:10000/db_table_name;AuthMech=1;KrbRealm=domain_name_here;KrbHostFQDN=dbserverhostname;KrbServiceName=hive;KrbAuthType=2

Click «Save» and see if the connection is successful. If it is, there should be no errors that pop up.