All Products
Search

This Product

    E-MapReduce:Kerberos authentication

    Document Center

    E-MapReduce:Kerberos authentication

    Last Updated:Jun 21, 2026

    Kerberos is an authentication protocol that uses symmetric-key cryptography to verify identities for other services. This topic describes how to access a Hive client when Kerberos authentication is enabled.

    Prerequisites

    A cluster must be created, and on the Software Configuration page, in the Advanced Settings section, the Kerberos Authentication switch must be enabled. For more information, see Create a cluster.

    Procedure

    1. Log on to the cluster over SSH. For more information, see Log on to a cluster.

    2. Run the following command to start the Kerberos admin.local tool.

      • If you log on to the master-1-1 node where the Kerberos Key Distribution Center (KDC) server runs as the root user, you can run the following command to directly access the admin tool.

        kadmin.local

        The following output indicates that you have entered the kadmin.local command-line interface:

        Authenticating as principal hadoop/admin@EMR.C-85D4B8D74296****.COM with password.
kadmin.local:

      • If you log on to another node or use a gateway, run the following command to access the admin tool.

        kadmin -p <admin-user> -w <admin-password>
        Note

        If you use the KDC provided by E-MapReduce, note the following parameters:

        • <admin-user>: The value is fixed to root/admin.

        • <admin-password>: In the E-MapReduce console, go to the Configure tab of the Kerberos service to get the value of the admin_pwd parameter.

        The following output indicates that you have entered the kadmin command-line interface:

        Authenticating as principal root/admin with password.
kadmin:

    3. Run the following command to create a principal named test.

      In this example, the password is 123456.

      addprinc -pw 123456 test

      The following output indicates that the principal was created successfully:

      Principal "test@EMR.C-85D4B8D74296****.COM" created.
      Note

      Record the username and password. You will need them to create a ticket-granting ticket (TGT).

      Run the quit command to exit the Kerberos admin.local tool.

    4. Log on to the machine where you want to run the Hive client, and run the following commands to create and switch to the test user.

      useradd test
su test

    5. Run the following command to create a TGT.

      kinit

      Press Enter and enter the password for the test user. In this example, the password is 123456.

    6. Connect to the Hive client.

      • Method 1: Run the hive command to access the Hive client.

        hive

      • Method 2: Use Beeline to access the Hive client.

        beeline -u "jdbc:hive2://master-1-1.c-56187feb57f0****.cn-hangzhou.emr.aliyuncs.com:10000/;principal=hive/_HOST@EMR.c-56187feb57f0****.COM"

        Replace the following placeholders with your information:

        • master-1-1.c-56187feb57f0****.cn-hangzhou.emr.aliyuncs.com: The fully qualified hostname, including the domain name. You can obtain the hostname by running the hostname -f command on the node where the HiveServer2 service runs (typically the master-1-1 node).

        • EMR.c-56187feb57f0****.COM: The realm name. In the E-MapReduce console, go to the Configure tab for the Kerberos service to find the value of the realm parameter.

    Related documents