kyuubi support LDAP and KERBREOS at the same time

[lugela]

How does kyuubi-defaults.conf in kyuubi support LDAP and KERBREOS at the same time? Can you give a configuration example? I am currently using according to the document configuration only one can exist

[pan3793]

How does kyuubi-defaults.conf in kyuubi support LDAP and KERBREOS at the same time?

As the docs say, kyuubi.authentication's value is "A comma-separated list of ...". Basically, to allow the client authenticated by Kerberos or LDAP, setting kyuubi.authentication=KERBEROS,LDAP, and setting the corresponding configurations, e.g. principal/keytab for Kerberos, baseDn for LDAP.

I am currently using according to the document configuration only one can exist

How do you come to this conclusion? Please quote the content of "according to the document" in your question.

[lugela]

It has been verified, thanks

[lugela]

Yesterday, the verification was not completed, and a problem was found that after being enabled simultaneously, only the LDAP method can be used normally, and the KERBEORS method authentication failed. Separate verification is normal

kyuubi-defaults.conf

kyuubi.authentication KERBEROS,LDAP

#KERBEROS
kyuubi.kinit.principal kyuubi/[email protected]
kyuubi.kinit.keytab /etc/security/keytabs/kyuubi.service.keytab


#LDAP
kyuubi.authentication.ldap.baseDN   dc=xxx,dc=com
kyuubi.authentication.ldap.domain   xxx.com
kyuubi.authentication.ldap.binddn   cn=Directory Manager
kyuubi.authentication.ldap.bindpw   admin123
kyuubi.authentication.ldap.url      ldap://ipa-test-replica.xxx.com:389
kyuubi.authentication.ldap.userDNPattern  uid=%s,CN=users,CN=accounts,DC=tebon,DC=com

#kyuubi.authentication.ldap.userDNPattern=uid=<username>,cn=users,cn=accounts,dc=tebon,dc=com
kyuubi.authentication.ldap.customLDAPQuery  (&(objectClass=person))

The command line uses tgt cache
When configuring both kerberos and ldap simultaneously

beeline -u "jdbc:hive2://hdp-ambari.xxx.com:2181,hdp-node1.xx.com:2181,hdp-node2.xx.com:2181,hdp-node3.xx.com:2181,hdp-snnode.tebon.com:2181/ods;principal=hive/[email protected];serviceDiscoveryMode=zooKeeper;zooKeeperNamespace=kyuubi?kyuubi.engine.share.level.subdomain=sd11"

Unknown HS2 problem when communicating with Thrift server.
Error: Could not open client transport for any of the Server URI's in ZooKeeper: Peer indicated failure: GSS initiate failed (state=08S01,code=0)
Beeline version 3.1.0.3.1.0.0-78 by Apache Hive

[pan3793]

Seems missing principal in the JDBC URL.

PS: Prefer to use plain text for logging and configurations (replace sensitive data with ***). The picture is not searchable, it's not friendly for further explorers.

[lugela]

Verify that principal=kyuubi/ [email protected] Able to access the beeline client, But I added the parameter kyuubi.ha.zookeeper.publish.configs true, which seems to have not taken effect

[pan3793]

I suppose kyuubi.ha.zookeeper.publish.configs should not work when dual authN is enabled, thus principal can not be eliminated.