1
2
/etc/init.d/hive-server2 start

1
2
hive --service hiveserver2

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
public synchronized void init(HiveConf hiveConf) {
this.hiveConf = hiveConf;
sessionManager = new SessionManager();
addService(sessionManager);
try {
HiveAuthFactory.loginFromKeytab(hiveConf);
serverUserName = ShimLoader.getHadoopShims().
getShortUserName(ShimLoader.getHadoopShims().getUGIForConf(hiveConf));
} catch (IOException e) {
throw new ServiceException("Unable to login to kerberos with given principal/keytab", e);
} catch (LoginException e) {
throw new ServiceException("Unable to login to kerberos with given principal/keytab", e);
}
super.init(hiveConf);
}

1
2
ShimLoader.getHadoopShims().getUGIForConf(hiveConf)

1
2
3
4
5
@Override
public UserGroupInformation getUGIForConf(Configuration conf) throws IOException {
return UserGroupInformation.getCurrentUser();
}

1
2
3
4
5
6
7
8
9
10
11
 public synchronized
static UserGroupInformation getCurrentUser() throws IOException {
AccessControlContext context = AccessController.getContext();
Subject subject = Subject.getSubject(context);
if (subject == null || subject.getPrincipals(User.class).isEmpty()) {
return getLoginUser();
} else {
return new UserGroupInformation(subject);
}
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

public synchronized
static UserGroupInformation getLoginUser() throws IOException {
if (loginUser == null) {
try {
Subject subject = new Subject();
LoginContext login;
if (isSecurityEnabled()) {
login = newLoginContext(HadoopConfiguration.USER_KERBEROS_CONFIG_NAME,
subject, new HadoopConfiguration());
} else {
login = newLoginContext(HadoopConfiguration.SIMPLE_CONFIG_NAME,
subject, new HadoopConfiguration());
}
login.login();
loginUser = new UserGroupInformation(subject);
loginUser.setLogin(login);
loginUser.setAuthenticationMethod(isSecurityEnabled() ?
AuthenticationMethod.KERBEROS :
AuthenticationMethod.SIMPLE);
loginUser = new UserGroupInformation(login.getSubject());
String fileLocation = System.getenv(HADOOP_TOKEN_FILE_LOCATION);
if (fileLocation != null) {
// Load the token storage file and put all of the tokens into the
// user. Don't use the FileSystem API for reading since it has a lock
// cycle (HADOOP-9212).
Credentials cred = Credentials.readTokenStorageFile(
new File(fileLocation), conf);
loginUser.addCredentials(cred);
}
loginUser.spawnAutoRenewalThreadForUserCreds();
} catch (LoginException le) {
LOG.debug("failure to login", le);
throw new IOException("failure to login", le);
}
if (LOG.isDebugEnabled()) {
LOG.debug("UGI loginUser:"+loginUser);
}
}
return loginUser;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
public static void test() {
try {
Class.forName("org.apache.hive.jdbc.HiveDriver");
Connection conn = DriverManager.getConnection(
"jdbc:hive2://june-mint:10000/default", "", "");
Statement stmt = conn.createStatement();
ResultSet rs = stmt.executeQuery("select count(1) from t");
while (rs.next())
System.out.println(rs.getString(1));
rs.close();
stmt.close();
conn.close();
} catch (SQLException se) {
se.printStackTrace();
} catch (Exception e) {
e.printStackTrace();
}
}

1
2
3
4
5
6
7

public void init(JobConf conf) throws IOException {
setConf(conf);
cluster = new Cluster(conf);
clientUgi = UserGroupInformation.getCurrentUser();
}

1
2
3
4
5
6
7
8
9
10
Job job = clientUgi.doAs(new PrivilegedExceptionAction<Job> () {
@Override
public Job run() throws IOException, ClassNotFoundException,
InterruptedException {
Job job = Job.getInstance(conf);
job.submit();
return job;
}
});

1
2
3
4
5
6
7
8
9
10
11
12

public static UserGroupInformation createRemoteUser(String user) {
if (user == null || "".equals(user)) {
throw new IllegalArgumentException("Null user");
}
Subject subject = new Subject();
subject.getPrincipals().add(new User(user));
UserGroupInformation result = new UserGroupInformation(subject);
result.setAuthenticationMethod(AuthenticationMethod.SIMPLE);
return result;
}

1
2
3
4
5
6
7
8
9
10
11
 public void init(JobConf conf) throws IOException {
setConf(conf);
cluster = new Cluster(conf);
if(UserGroupInformation.isSecurityEnabled()){
clientUgi = UserGroupInformation.getCurrentUser();
}else{
String user = conf.get("myExecuteName","NoName");
clientUgi = UserGroupInformation.createRemoteUser(user);
}
}

1
2
3
4
5
6
7
8
9
10
11
12
13
Caused by: org.apache.hadoop.security.AccessControlException: Permission denied: user=NoName, access=WRITE, inode="/tmp/hive-june/hive_2013-10-18_21-18-12_812_378750610917949668/_tmp.-ext-10001":june:hadoop:drwxr-xr-x
at org.apache.hadoop.hdfs.server.namenode.FSPermissionChecker.check(FSPermissionChecker.java:224)
at org.apache.hadoop.hdfs.server.namenode.FSPermissionChecker.check(FSPermissionChecker.java:204)
at org.apache.hadoop.hdfs.server.namenode.FSPermissionChecker.checkPermission(FSPermissionChecker.java:149)
at org.apache.hadoop.hdfs.server.namenode.FSNamesystem.checkPermission(FSNamesystem.java:4705)
at org.apache.hadoop.hdfs.server.namenode.FSNamesystem.checkPermission(FSNamesystem.java:4687)
at org.apache.hadoop.hdfs.server.namenode.FSNamesystem.checkAncestorAccess(FSNamesystem.java:4661)
at org.apache.hadoop.hdfs.server.namenode.FSNamesystem.renameToInternal(FSNamesystem.java:2696)
at org.apache.hadoop.hdfs.server.namenode.FSNamesystem.renameToInt(FSNamesystem.java:2663)
at org.apache.hadoop.hdfs.server.namenode.FSNamesystem.renameTo(FSNamesystem.java:2642)
at org.apache.hadoop.hdfs.server.namenode.NameNodeRpcServer.rename(NameNodeRpcServer.java:610)
at org.apache.hadoop.hdfs.protocolPB.ClientNamenodeProtocolServerSideTranslatorPB.rename

1
2
3
4
5
6
7
8
9
[root@edh1 lib]# hadoop fs -ls /tmp/
Found 6 items
drwx------
- june hadoop
0 2013-10-15 01:33 /tmp/hadoop-yarn
drwxr-xr-x
- june hadoop
0 2013-10-16 06:52 /tmp/hive-june

1
2
3
4
5
6
7
8
9
10
11

String user = conf.get(myExecuteName，“”);
if (user != null && user.trim().length() > 0) {
nonLocalScratchPath =
new Path("/tmp/hive-" + user, executionId);
} else {
nonLocalScratchPath =
new Path(HiveConf.getVar(conf, HiveConf.ConfVars.SCRATCHDIR),
executionId);
}

1
2
3
4
public OperationHandle executeStatement(String statement, Map<String, String> confOverlay) throws HiveSQLException{}
public void cancelOperation(final OperationHandle opHandle) throws HiveSQLException {}
public void closeOperation(final OperationHandle opHandle) throws HiveSQLException {}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

if (operation instanceof SQLOperation) {
try {
String user = hiveConf.getVar(ConfVars.HIVE_SERVER2_MAPREDUCE_USERNAME);
ugi = UserGroupInformation.createRemoteUser(user);
ugi.doAs(new PrivilegedExceptionAction<CommandProcessorResponse>() {
@Override
public CommandProcessorResponse run() throws HiveSQLException {
operation.run();
return null;
}
});
} catch (IOException e) {
e.printStackTrace();
} catch (InterruptedException e) {
e.printStackTrace();
}
} else {
operation.run();
}

1
2
3
4
5
6
Statement stmt = conn.createStatement();
stmt.execute("set myExecuteName=aaaa");
ResultSet rs = stmt.executeQuery("select count(1) from t");
while (rs.next())
System.out.println(rs.getString(1));

1
2
3
4
5
org.apache.hadoop.mapred.JobClient //从环境变量获取从jdbc客户端传过来的用户，即myExecuteName的值，然后以该值运行mapreduce用户
org.apache.hadoop.hive.ql.Context
//修改hive.exec.scratchdir的地址为从jdbc客户端传过来的用户对应的临时目录
org.apache.hive.service.cli.session.HiveSessionImpl //修改运行sql、取消操作、关闭连接对应的方法

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
[root@edh1 lib]# hadoop fs -ls /tmp/
Found 7 items
drwx------
- june
hadoop
0 2013-10-15 01:33 /tmp/hadoop-yarn
drwxr-xr-x
- javachen.com hadoop
0 2013-10-16 07:30 /tmp/hive-javachen.com
drwxr-xr-x
- june
hadoop
0 2013-10-16 06:52 /tmp/hive-june
drwxr-xr-x
- root
hadoop
0 2013-10-15 14:13 /tmp/hive-root
drwxrwxrwt
- yarn
mapred
0 2013-10-16 07:30 /tmp/logs