E-MapReduce:Connect to a Kerberos-enabled Hive using Java

Add Maven dependencies

Add the following dependencies to your pom.xml:

<dependencies>
    <dependency>
        <groupId>org.apache.hive</groupId>
        <artifactId>hive-jdbc</artifactId>
        <version>3.1.3</version>
    </dependency>
    <dependency>
        <groupId>org.apache.hadoop</groupId>
        <artifactId>hadoop-common</artifactId>
        <version>3.2.1</version>
    </dependency>
    <dependency>
        <groupId>org.apache.hadoop</groupId>
        <artifactId>hadoop-auth</artifactId>
        <version>3.2.1</version>
    </dependency>
</dependencies>

Sample code

Replace the placeholder values with the default_realm and principal you retrieved in steps 1 and 2, then copy the code into Main.java.

package com.aliyun.emr.example;

import org.apache.hadoop.conf.Configuration;
import org.apache.hadoop.security.UserGroupInformation;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.ResultSet;
import java.sql.Statement;

public class Main {
    private static final String DRIVER_CLASS = "org.apache.hive.jdbc.HiveDriver";

    public static void main(String[] args) throws Exception {
        // Set the Kerberos realm and KDC address (from krb5.conf in Step 1)
        System.setProperty("java.security.krb5.realm", "EMR.EXAMPLE.COM");
        System.setProperty("java.security.krb5.kdc", "<master-node-address>");

        Configuration conf = new Configuration();
        conf.set("hadoop.security.authentication", "kerberos");
        UserGroupInformation.setConfiguration(conf);

        // Authenticate using the keytab file (principal from Step 2)
        UserGroupInformation.loginUserFromKeytab(
            "hive/master-1-1.c-EXAMPLE.cn-hangzhou.emr.aliyuncs.com@EMR.C-EXAMPLE.COM",
            "/tmp/hive.keytab"
        );

        Class.forName(DRIVER_CLASS);

        // The principal in the JDBC URL must match the principal used in loginUserFromKeytab above.
        // Note: the "/" after the port number is required. If you omit it, the driver runs
        // HiveServer2 in embedded mode instead of connecting to the remote server.
        String hivePrincipal = "hive/master-1-1.c-EXAMPLE.cn-hangzhou.emr.aliyuncs.com@EMR.C-EXAMPLE.COM";
        String hiveUrl = "jdbc:hive2://<master-node-address>:10000/;principal=" + hivePrincipal;
        Connection connection = DriverManager.getConnection(hiveUrl);
        Statement statement = connection.createStatement();

        ResultSet resultSet = statement.executeQuery("SHOW DATABASES");
        while (resultSet.next()) {
            System.out.println(resultSet.getString(1));
        }

        resultSet.close();
        statement.close();
        connection.close();
    }
}

Parameter reference

Verify network connectivity

Before debugging Java errors, confirm that your machine can reach the KDC port:

nc -zv <master-node-address> 88

A successful connection confirms network access to the KDC. If this fails, review the security group rule from Step 3.

Verify the keytab

Confirm that the keytab is valid and the principal is correct:

klist -kt /tmp/hive.keytab

Then test authentication end-to-end:

kinit -kt /tmp/hive.keytab hive/master-1-1.c-EXAMPLE.cn-hangzhou.emr.aliyuncs.com@EMR.C-EXAMPLE.COM
klist

A ticket in the klist output confirms the keytab works. If kinit fails, the keytab or principal is incorrect.

Enable Kerberos debug output

To see detailed Kerberos negotiation logs, add this line at the start of your main method:

System.setProperty("sun.security.krb5.debug", "true");

This writes Kerberos debug output from the JVM's Kerberos libraries to stdout. The output shows each step of the authentication handshake and helps identify where the negotiation fails. The amount of detail varies depending on which stage fails — exception messages and stack traces typically point to the root cause. For more details, see Troubleshooting security in the Java documentation.

Common errors

For errors not listed here, see Common Kerberos error messages (A-M) and Common Kerberos error messages (N-Z) from Oracle, and the MIT Kerberos troubleshooting guide.