Kerberos implementation SAS for Hive Connection

Kerberos steps:

Get the keytab file for the user which you are using to connect to Hadoop. For example: if hive is the user name then AD team will provide keytab file for it.

1.    Installation of required packages

• krb5-workstation
• krb5-auth-dialog

Keytab file will be used to generate ticket:

kinit -k -t hive.keytab hive@ZONE.BLOG.NET

Use the proper krb5.conf , by default will be /etc but get it from right team

Possible Errors:

kinit: Included profile directory could not be read while initializing Kerberos 5 library – This means the krb5.conf file we are using wrong.

1.    Add Kerberos changes to sasenv_local

File Location -> /opt/SASHome/SASFoundation/9.4/bin

workspace_user=$(whoami)

export KRB5_CONFIG=/etc/krb5.conf

export KRB5_KTNAME=/home/$workspace_user/kerb_files/hive.keytab

/usr/bin/kinit -k -t /home/$workspace_user/kerb_files/hive.keytab hive@ZONE.BLOG.NET

workspace_user=$(whoami)

workspace_user_ccaches=$(find /tmp -maxdepth 1 -user ${workspace_user} -type f -name "krb5cc_*" -printf '%T@ %p\n' | sort -k 1nr | sed 's/^[^ ]* //' | head -n 1)

if test ! -z "$workspace_user_ccaches"; then

echo "Most recent krb5 ccache found for '${workspace_user}' at '${workspace_user_ccaches}'."

echo "Cache last modified: $(stat -c%y ${workspace_user_ccaches})"

export KRB5CCNAME=$workspace_user_ccaches

echo "KRB5CCNAME has been set to ${KRB5CCNAME}."

else

echo "No krb5 credentials caches were found in /tmp for '${workspace_user}'."

fi

Importing JKS, this JKS is generated in Hadoop server by SAS Team

    In Hadoop Server:

     echo -n | openssl s_client -connect kerberoshost.hadoophost.com:10000 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' >       hive_kerberoshost.hadoophost.com.pem

 keytool -import -alias kerberoshost.hadoophost.com -file hive_kerberoshost.hadoophost.com.pem -keystore          hivetrust.jks

In SAS Server:

cd /opt/SASHome/SASPrivateJavaRuntimeEnvironment/9.4/jre/bin

./keytool -importkeystore -srckeystore /tmp/hivetrust.jks -destkeystore ../lib/security/jssecacerts

Possible Error:

keytool error: java.io.FileNotFoundException: /home/sasdemo/kerb_files/hivetrust_gen_new.jks (Permission denied) : It means you are giving wrong password. If you keep get this message, then regenerate new jks file with simple text only password. I got error while using alphanumeric password.

Libname and Issues:

%let SAS_HADOOP_CONFIG_PATH=/tmp/sitexmls;

%let SAS_HADOOP_JAR_PATH=/tmp/jars;

options set=SAS_HADOOP_CONFIG_PATH="&SAS_HADOOP_CONFIG_PATH.";

options set=SAS_HADOOP_JAR_PATH="&SAS_HADOOP_JAR_PATH.";