一、官网说明
Authentication/Security Configuration
HiveServer2 supports Anonymous (no authentication) with and without SASL, Kerberos (GSSAPI), pass through LDAP, Pluggable Custom Authentication and Pluggable Authentication Modules (PAM, supported Hive 0.13 onwards).
Authentication mode:
hive.server2.authentication – Authentication mode, default NONE. Options are NONE (uses plain SASL), NOSASL, KERBEROS, LDAP, PAM and CUSTOM.
Set following for CUSTOM mode:
hive.server2.custom.authentication.class – Custom authentication class that implements the org.apache.hive.service.auth.PasswdAuthenticationProvider interface.
官网:SettingUpHiveServer2-Authentication/SecurityConfiguration
二、实现
实现逻辑:
- 实现org.apache.hive.service.auth.PasswdAuthenticationProvider接口,打包放到>${hive_home}/lib 下
- 配置hive-site.xml 在每一个hiveserver安装的地方
- 重启hiveserver
实现类:
逻辑很简单,读取hive.jdbc_passwd.auth配置,识别用户和密码。如果没有配置或者匹配不成功则抛出异常。
import org.apache.hadoop.conf.Configuration;
import org.apache.hadoop.hive.conf.HiveConf;
import org.apache.hive.service.auth.PasswdAuthenticationProvider;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import javax.security.sasl.AuthenticationException;
/**
* @Description TODO
* @Author lianggao
* @Date 2023/6/12 下午3:45
*/
public class CustomPasswdAuthenticator implements PasswdAuthenticationProvider {
private Logger LOG = LoggerFactory.getLogger(CustomPasswdAuthenticator.class);
private static final String HIVE_JDBC_PASSWD_AUTH_PREFIX = "hive.jdbc_passwd.auth.%s";
private Configuration conf = null;
public CustomPasswdAuthenticator() {
}
public void Authenticate(String userName, String passwd) throws AuthenticationException {
LOG.info("user: " + userName + " try login.");
String passwdConf = this.getConf().get(String.format("hive.jdbc_passwd.auth.%s", userName));
String message;
if (passwdConf == null) {
message = "user's ACL configration is not found. user:" + userName;
LOG.info(message);
throw new AuthenticationException(message);
} else if (!passwd.equals(passwdConf)) {
message = "user name and password is mismatch. user:" + userName;
throw new AuthenticationException(message);
}
}
public Configuration getConf() {
if (this.conf == null) {
this.conf = new Configuration(new HiveConf());
}
return this.conf;
}
public void setConf(Configuration conf) {
this.conf = conf;
}
}
修改hive-site.xml
<!--自定义远程连接用户名和密码-->
<property>
<name>hive.server2.authentication</name>
<value>CUSTOM</value><!--默认为none,修改成CUSTOM-->
</property>
<!--指定解析jar包-->
<property>
<name>hive.server2.custom.authentication.class</name>
<value>org.apache.hadoop.hive.contrib.auth.CustomPasswdAuthenticator</value>
</property>
<!--设置用户名和密码-->
<property>
<name>hive.jdbc_passwd.auth.usename1111</name><!--用户名识别为:usename1111-->
<value>pswd1111</value><!--密码-->
</property>
重启hiveserver
jps
kill -9 hive_server_pid
nohup ./hive --service hiveserver2 >> /tmp/hiveserver2.log 2>&1
通过beeline连接hive测试:
beeline -u jdbc:hive2://hostname:10000 -n usename1111 -p pswd1111
三、第二个实现
可以将用户名、密码提前写到实现类中,这样hive-site.xml的配置将更加简练
package hive.test;
import java.util.Hashtable;
import javax.security.sasl.AuthenticationException;
import org.apache.hive.service.auth.PasswdAuthenticationProvider;
/*
javac -cp $HIVE_HOME/lib/hive-service-0.11-mapr.jar SampleAuthenticator.java -d .
jar cf sampleauth.jar hive
cp sampleauth.jar $HIVE_HOME/lib/.
*/
public class SampleAuthenticator implements PasswdAuthenticationProvider {
Hashtable<String, String> store = null;
public SampleAuthenticator () {
store = new Hashtable<String, String>();
store.put("user1", "passwd1");
store.put("user2", "passwd2");
}
@Override
public void Authenticate(String user, String password)
throws AuthenticationException {
String storedPasswd = store.get(user);
if (storedPasswd != null && storedPasswd.equals(password))
return;
throw new AuthenticationException("SampleAuthenticator: Error validating user");
}
}
hive-site.xml
<property>
<name>hive.server2.authentication</name>
<value>CUSTOM</value>
</property>
<property>
<name>hive.server2.custom.authentication.class</name>
<value>hive.test.SampleAuthenticator</value>
</property>
参考:
https://docs.ezmeral.hpe.com/datafabric-customer-managed/72/Hive/HiveServer2-CustomAuth.html