Trino connect hive auth kerberos

[stbogdan77]

I have a problem connecting the trino to the hive

• connector.name=hive
• hive.metastore.uri=thrift://server5:9083
• hive.config.resources=/trino/etc/core-site.xml, /trino/etc/hdfs-site.xml, /trino/etc/hive-site.xml
• hive.metastore.authentication.type=KERBEROS
• hive.metastore.username=trino
• hive.metastore.thrift.impersonation.enabled=true
• hive.metastore.service.principal=krb55/[email protected]
• hive.metastore.client.principal=[email protected]
• hive.metastore.client.keytab=/trino/etc/key/trino.keytab
• hive.hdfs.authentication.type=KERBEROS
• hive.hdfs.impersonation.enabled=true
• hive.hdfs.trino.principal=[email protected]
• hive.hdfs.trino.keytab=/trino/etc/key/trino.keytab

If I try to connect via JDBC:POSTGRESQL, the config is like this and I don’t understand the error, if I open the database with these credentials everything works.

• connector.name=iceberg
• iceberg.compression-codec=gzip
• iceberg.catalog.type=jdbc
• iceberg.jdbc-catalog.catalog-name=test
• iceberg.jdbc-catalog.driver-class=org.postgresql.Driver
• iceberg.jdbc-catalog.connection-url=jdbc:postgresql://postgres1:5432/metastore
• iceberg.jdbc-catalog.connection-user=hive
• iceberg.jdbc-catalog.connection-password=**************
• iceberg.jdbc-catalog.default-warehouse-dir=hdfs://********//user/hive/warehouse

I'm just trying to see what tables are inside my directory

[Akanksha-kedia]

Kerberos uses the hive.metastore.client.principal and hive.metastore.client.keytab properties for authentication, so the hive.metastore.username property is unnecessary and can cause issues.

Here's how your configuration should look:

connector.name=hive
hive.metastore.uri=thrift://server5:9083
hive.config.resources=/trino/etc/core-site.xml, /trino/etc/hdfs-site.xml, /trino/etc/hive-site.xml
hive.metastore.authentication.type=KERBEROS
hive.metastore.thrift.impersonation.enabled=true
hive.metastore.service.principal=krb55/[email protected]
hive.metastore.client.principal=[email protected]
hive.metastore.client.keytab=/trino/etc/key/trino.keytab
hive.hdfs.authentication.type=KERBEROS
hive.hdfs.impersonation.enabled=true
hive.hdfs.trino.principal=[email protected]
hive.hdfs.trino.keytab=/trino/etc/key/trino.keytab.

[Akanksha-kedia]

hive.metastore.service.principal=hive/[email protected]
Note: The principal krb55/[email protected] you provided doesn't look like a typical Hive metastore service principal. Please ensure you're using the correct principal.

[akenO8]

@Akanksha-kedia May I ask, If front of the HMS have a LB proxy, what should the value of hive.metastore.service.principal should be?

[stbogdan77]

This is an error on the hivemetastore server in the logs