Repository: apache/airflow

Issue:
hive ldap with auth=noSasl bug
i have a little troube with CDH 5 cluster:
with 

```
<property>
  <name>hive.server2.authentication</name>
  <value>LDAP</value>
</property>
```

this change useful for properly working:

``` diff
diff --git a/airflow/hooks/hive_hooks.py b/airflow/hooks/hive_hooks.py
index 794c78a..ca15a64 100644
--- a/airflow/hooks/hive_hooks.py
+++ b/airflow/hooks/hive_hooks.py
@@ -86,7 +86,7 @@ class HiveCliHook(BaseHook):
                         jdbc_url = (
                             "jdbc:hive2://"
                             "{0}:{1}/{2}"
-                            ";auth=noSasl"
+                            #";auth=noSasl"
                         ).format(conn.host, conn.port, conn.schema)

                     cmd_extra += ['-u', jdbc_url]
```

i.e. NO sasl parameter need in this case, can u fix it?



Discussion:
Instead of removing the "auth=noSasl" part from hive_hooks.py, it may be better to make the auth mechanism configurable from outside (e.g. we're using mapr with auth=maprsasl, and did this via a quick local fix). What would be the best place for such a configuration? I suppose the connection config? If the direction is clear, I'd be happy to contribute.

of course, it`s right way, appending it into Extras or whole auth config will be ok/

It might actually be better to parse hive-site.xml instead and to pick it up from there. Or are there case  where this config is not available? Or maybe even better make this configurable so you can do both.

The connection's extra attributes is the way to go

What I did for this type of issue was created a customized hook and operator. Get the authentication setting from the connection and check it in customized hook.

> > It might actually be better to parse hive-site.xml instead and to pick it up from there.
1. It`s look like implicit behavior (not good idea)
2. you need to find hive.conf and it is not so easy ... 99% it is default /etc/hive but in 1% you need to parse hive config files. Configure it into **Connections** sounds like ok.;

Oh i found that it is already realised here :

``` python
class HiveServer2Hook(BaseHook): 
...
        auth_mechanism = db.extra_dejson.get('authMechanism', 'NOSASL')
```

all you need just copy paste it there. Thanks !


Resolving patch:
diff --git a/airflow/hooks/hive_hooks.py b/airflow/hooks/hive_hooks.py
--- a/airflow/hooks/hive_hooks.py
+++ b/airflow/hooks/hive_hooks.py
@@ -31,6 +31,10 @@ class HiveCliHook(BaseHook):
     Note that you can also set default hive CLI parameters using the
     ``hive_cli_params`` to be used in your connection as in
     ``{"hive_cli_params": "-hiveconf mapred.job.tracker=some.jobtracker:444"}``
+
+    The extra connection parameter ``auth`` gets passed as in the ``jdbc``
+    connection string as is.
+
     """
 
     def __init__(
@@ -40,6 +44,7 @@ def __init__(
         conn = self.get_connection(hive_cli_conn_id)
         self.hive_cli_params = conn.extra_dejson.get('hive_cli_params', '')
         self.use_beeline = conn.extra_dejson.get('use_beeline', False)
+        self.auth = conn.extra_dejson.get('auth', 'noSasl')
         self.conn = conn
         self.run_as = run_as
 
@@ -67,6 +72,7 @@ def run_cli(self, hql, schema=None, verbose=True):
 
                 if self.use_beeline:
                     hive_bin = 'beeline'
+                    jdbc_url = "jdbc:hive2://{conn.host}:{conn.port}/{conn.schema}"
                     if configuration.get('core', 'security') == 'kerberos':
                         template = conn.extra_dejson.get('principal', "hive/_HOST@EXAMPLE.COM")
                         if "_HOST" in template:
@@ -78,17 +84,11 @@ def run_cli(self, hql, schema=None, verbose=True):
                         elif conn.extra_dejson.get('proxy_user') == "owner" and self.run_as:
                             proxy_user = "hive.server2.proxy.user={0}".format(self.run_as)
 
-                        jdbc_url = (
-                            "jdbc:hive2://"
-                            "{0}:{1}/{2}"
-                            ";principal={3};{4}"
-                        ).format(conn.host, conn.port, conn.schema, template, proxy_user)
-                    else:
-                        jdbc_url = (
-                            "jdbc:hive2://"
-                            "{0}:{1}/{2}"
-                            ";auth=noSasl"
-                        ).format(conn.host, conn.port, conn.schema)
+                        jdbc_url += ";principal={template};{proxy_user}"
+                    elif self.auth:
+                        jdbc_url += ";auth=" + self.auth
+
+                    jdbc_url = jdbc_url.format(**locals())
 
                     cmd_extra += ['-u', jdbc_url]
                     if conn.login:


Test patch: