Version 6

    In this article, I will provide step by step "how to" instructions to use Kerberos authentication from Teiid to HDP platform. It is expected that the user has knowledge about Kerberos authentication and have gathered all the necessary configuration and keytabs before starting this exercise. it is also expected that HDP platform is already configured with Kerberos and tested to work correctly with tools like Beeline. The instructions in the article are for Teiid and WildFly configuration.


    For the purposes of this article, we used HDP platform version HDP,  JDBC driver for this version can be found in installation directory in /usr/hdp/ Before we proceed further let's first make sure HDP connects with simple JDBC class using Kerberos. Use below code to make direct JDBC connection to HDP to verify.


    JDBC-based clients must includeprincipal=<HiveServer2-Kerberos-Principal> in the JDBC connection string. For example hive/localhost@EXAMPLE.COM

    <HOSTNAME> is the name of the host where HiveServer2 is installed in below server which MUST be replaced with real name.


    import java.sql.Connection;
    import java.util.Properties;
    import org.apache.hive.jdbc.HiveDriver;
    public class Main{
        public static void main(String... args) throws Exception {
            System.setProperty("", "/path/to/dv.conf");
            System.setProperty("", "true");
            LoginContext c = new LoginContext("dv");
            Subject.doAs(c.getSubject(), (PrivilegedAction<Object>)() -> {
                    HiveDriver d = new HiveDriver();
                    Connection con = d.connect("jdbc:hive2://<HOSTNAME>:10000/default;principal=hive/<HOSTNAME>@EXAMPLE.COM;auth=kerberos;kerberosAuthType=fromSubject", new Properties());
                    ResultSet rs = con.createStatement().executeQuery("select current_user()");
                    System.out.println("Logged in user="+rs.getString(1));
                } catch (Exception ex){
                return null;


    with dv.conf file contents like (a variation of this file can be used to make use of ticket cache too)


    dv { required


    When you execute the above code, the DV user should be printed to the console. Now if this is successful, then now we are ready to for configuration in Teiid/WildFly.


    Log into HDP using the Kerberos authentication From Teiid/WildFly


    First, we need to create a module for Hive JDBC driver. In the "modules/system/layer/dv/org/hdp/hive/main" directory create a file called module.xml with following contents


    <?xml version="1.0" encoding="UTF-8"?>
    <module xmlns="urn:jboss:module:1.0" name="org.hdp.hive">
            <resource-root path="hive-jdbc-1.2.1000."/>
            <module name="javax.api"/>
            <module name="javax.resource.api"/>
            <module name="sun.jdk"/>
            <system export="true">
                    <path name="sun/security/krb5/internal"/>

    and make sure you copy the Hive JDBC jar file in the same directory from the installation directory mentioned above.



    Edit the standalone.xml, could be standalone-teiid.xml depending on how you installed Teiid, and add the following in DataSources subsystem, create connection configuration as


    <datasource jndi-name="java:/hive_krb" pool-name="hive_krb" enabled="true">
        <driver name="hive" module="org.hdp.hive">


    The <security-domain> element defines the JAAS security domain to be used with the Oracle connection. Now let's configure the security domain specific details. Edit the standalone.xml and add


       <property name="" value="${jboss.home.dir}/krb5.conf"/>
       <property name="" value="true"/>


    My sample krb5.conf file looks like


      debug = true
      dns_lookup_realm = false
      rdns = false
      forwardable = true
      ticket_lifetime = 24h
      renew_lifetime = 7d
      max_renewable_life = 7d
      default_realm = EXAMPLE.COM
     EXAMPLE.COM = {
       kdc =
       default_domain = EXAMPLE.COM
    [domain_realm] = EXAMPLE.COM = EXAMPLE.COM
      krb4_convert = true
      krb4_get_tickets = false
      debug = true
      ticket_lifetime = 36000
      renew_lifetime = 36000
      krb4_convert = false


    copy this file krb5.conf into where Teiid/WildFly is installed, in the home directory.


    Continue editing the standalone.xml and add security-domain in "security" subsystem (Make sure the below configuration does not use caching, i.e cache-type either ignored or set to "none")

    <security-domain name="hive_krb">
            <login-module code="Kerberos" flag="required" module="">
                <module-option name="storeKey" value="true"/>
                <module-option name="useKeyTab" value="true"/>
                <module-option name="keyTab" value="${jboss.home.dir}/DV.keytab"/>
                <module-option name="principal" value="DV@EXAMPLE.COM"/>
                <module-option name="doNotPrompt" value="true"/>
                <module-option name="debug" value="true"/>
                <module-option name="refreshKrb5Config" value="false"/>
                <module-option name="addGSSCredential" value="true"/>


    Copy the Key Tab file for user "DV " into the Teiid/WildFly home directory. Now save the file, and start the Teiid server. Deploy a test VDB like



    <?xml version="1.0" encoding="utf-8"?>
    <vdb name="test_hive" version="1">
      <model name="usr" type="PHYSICAL">
        <source name="usr" connection-jndi-name="java:/hive_krb" translator-name="hive-over"/>
        <metadata type="NATIVE"/>
        <metadata type="DDL"><![CDATA[
               CREATE FOREIGN FUNCTION current_user() RETURNS string;
      <translator name="hive-over" type="hive">
        <property name="SupportsDirectQueryProcedure" value="true"/>


    Now using your favorite JDBC client, connect to the "test_hive" vdb and issue a query


    SELECT usr.current_user()


    And the DV user should be visible there.


    If you want to use "service account" with key tab on your Teiid/WildFly server instead using an individual's credentials, in the configuration above replace, "DV@EXAMPLE.COM" with "SERVICE_ACCT/host@EXAMPLE.COM" and replace with DV.keytab with SERVICE_ACCT.keytab


    Pass-Through Authentication to HDP


    To be continued.





    IBM Knowledge Center

    HiveServer2 Security Configuration