Configuring Oracle GoldenGate Veridata Agent Using Kerberos to Connect to Hive

Complete the steps detailed in unresolvable-reference.html#GUID-9312C00A-4235-47CD-9976-C482DE47958A.

Obtain the Kerberos configuration file from the kerberos server, for example, krb5.conf.

Copy the Kerberos configuration file in the OS default location. For example, in Linux, it is /etc/.

For Hive specific configurations, review: VERIDATA_AGENT_HOME/veridata/agent/sample_properties/agent.properties.hive.

Obtain the the keytab file from Kerberos enabled Hive environment.

Copy the keytab file into the Oracle GoldenGate Veridata Agent deploy directory.

In the agent.properties file, add/uncomment, and edit the entries hive.kerberos.keytab.file.name and enter the keytab file name.

Edit agent.properties and add the database.url. For Kerberos authentication principal argument is required. For example, in a Cloudera Hive, following is the jdbc url syntax: .

database.url=jdbc:hive2://<Hive server
                                                  host>:10000/default;principal=hive/HiveServerHost@YOUR-REALM.COM

Edit agent.properties.hive and add the server.jdbcDriver appropriately. For example, for Cloudera Hive:

server.jdbcDriver=commons-collections-3.2.1.jar hadoop-common-2.4.1.jar
hive-service-0.14.0.jar hadoop-mapreduce-client-core-2.4.1.jar hive-shims-common-0.14.0.jar
commons-logging-1.1.3.jar hive-exec-0.14.0.jar log4j-1.2.17.jar hive-jdbc-0.14.0-standalone.jar
slf4j-api-1.7.5.jar hadoop-auth-2.4.1.jar hive-metastore-0.14.0.jar slf4j-log4j12-1.7.5.jar
commons-configuration-1.6.jar commons-dbcp2-2.5.0.jar commons-pool2-2.6.0.jar

Obtain the appropriate versions of these jars from Hive environment.

Initiate an initial ticket granting ticket for the principal using kinit. Go to the agent installation directory and run kinit and verify using:

klist: kinit
-k -t  {keytab file}  {principal name}

Note:

For auto renewal of Kerberos ticket, add the hive.kerberos.principal.override property in the agent.properties file as follows:

hive.kerberos.principal.override=<Principal
                                                  name>

. If you do not mention the Principal name, then Oracle GoldenGate Veridata uses the principal name form the database.url.

Start the Oracle GoldenGate Veridata Agent.

Verify connection in UI.

Note:

In case you have permission-related issues, you may have to enter the Hadoop username and password in Database details. First, try without using the username and password.