Configuring Hive Metastore Authentication

This section describes how to configure the hive.metastore.authentication property for secured and unsecured clusters. It describes cases when the property must be configured explicitly and when it can be omitted from hive-site.xml.

Hive Metastore supports two types of authentication: MAPRSASL and KERBEROS. At startup, Hive Metastore reads the system property metastore.auth. If metastore.auth is equal to null, then the authentication type is NONE. Otherwise, Hive Metastore takes the value of the system property metastore.auth and assigns it to the Hive Metastore configuration property hive.metastore.authentication.

You do not need to set up the metastore.auth system property manually. If a cluster is secured, Hive assigns the MAPRSASL value to the metastore.auth property. If a cluster is not secured, Hive assigns the NONE value to the metastore.auth property.

To enable Kerberos authentication, set the value of hive.metastore.authentication directly in hive-site.xml, as shown in the following table:

Table 1. Configuring Hive Metastore Authentication
Security Value of hive.metastore.authentication Notes
No security NONE The value is set automatically. You do not need to make an entry in hive-site.xml.
MapR SASL security MAPRSASL The value is set automatically. You do not need to make an entry in hive-site.xml.
Kerberos security KERBEROS You must make the following entry in hive-site.xml:
<property>
<name>hive.metastore.authentication</name>
<value>KERBEROS</value>
</property>