DBeaver / DBVisualizer connectivity to Kerberized Hive on Windows— including JAAS configuration
By: Santhosh G
Tags: Windows, Dbvisualizer, Dbeaver, Hive, Kerberos

It has been a night mare for many to connect 3rd party tools such as DBeaver and/or DBVisualizer to open a Hive connection with Kerberos on Windows. I wanted to start with some major observations before going through required configuration.

Kerberos utilities such as kinit, klist comes with native Java that is installed along with DBeaver or DBVisualizer. The intent is to use them instead of installing Kerberos client on Windows

DBeaver looks at the following config by default on Windows.

Krb5 Config → C:\Windows\krb5.ini

Krb5 Credentials cache → C:\Users\<user.name>\krb5cc_<user.name>

DBVisualizer looks at the following config by default on Windows

Krb5 Config → C:\kerberos\krb5.ini

Krb5 Credentials cache → C:\Users\<user.name>\krb5cc_<user.name>

To bypass these default values, following arguments can be used in dbeaver.ini and General Properties of DBVisualizer

-Djava.security.krb5.conf=C:/Users/<user.name>/DBeaver/krb5.ini

-Djava.security.auth.login.config=C:/Users/<user.name>/DBeaver/jaas.conf

To debug Krb5, use -Dsun.security.krb5.debug=true

Fine, now lets quickly review DBeaver Configuration. After installing DBeaver, ensure that the following files are updated/appended with these values

Append following lines to dbeaver.ini located in <DBeaver_Home>.

Important Note: Ensure to use backslashes ( / ) and not forward slashes ( \ ). Java configurations treat \ as escape sequences.

-Djavax.security.auth.useSubjectCredsOnly=false

-Dsun.security.krb5.debug=true

-Djava.security.krb5.conf=C:/Users/<user.name>/DBeaver/krb5.ini

-Djava.security.auth.login.config=C:/Users/<user.name>/DBeaver/jaas.conf

2. Copy /etc/krb5/krb5.conf from one of the nodes and rename it as krb5.ini to be placed in a location mentioned in dbeaver.ini — Plz note that there are no changes needed on this file, however ensure that default Realm is set and can be pinged from your desktop.

3. Create a new file for JAAS configuration. This will enable DBeaver to automatically initialize a Kerberos ticket using a keytab and when there is no credentials cache available already. Ensure that keytab location and principal associated to keytab are correct. Name this file as jaas.conf and place it in the path mentioned in dbeaver.ini

Important Note: Ensure to use backslashes ( / ) and not forward slashes ( \ ). Java configurations treat \ as escape sequences.

4. Now, create a new database connection in DBeaver and use the following JDBC URL to connect to Kerberized Hive db.

5. Test connection will be successful with the above configuration. If there is an issue, check debug logs in

C:\Users\<user.name>\AppData\Roaming\DBeaverData\workspace6\.metadata\dbeaver-debug.log

It is advised to remove all lines with debug once the connection is established.

For DBVisualizer, the same arguments will have to be used as mentioned for dbeaver.ini, however it must be added in Tools → Tool Properties → General

DBVisualizer Configuration : Tool Properties

Use the following JDBC URL to connect to Kerberized Hive db.

Final Notes:

I took some time to write this post only because there was no proper information other than https://justnumbersandthings.com/post/2017-05-06-dbeaver-hive/ .. But many of the information in the post was generic and didn’t work for DBeaver installed on Windows. I sincerely hope this post will be useful, and will work if the above configurations are used properly. If not, debug files will help troubleshooting Kerberos related errors.

On a side note, if you want to understand more about the arguments and parameters used in jaas.conf, plz take a look at this guide http://cr.openjdk.java.net/~weijun/special/krb5winguide-2/raw_files/new/kwin

Best Wishes !