0

I’ve spent a lot of time trying to make a connection with a kereberized impala server through python. It was possible with java jdbc. I don’t think this is a kereberos ticket problem. If I run klist I can see my ticket without problem.

Ticket cache: FILE:/tmp/krb5cc_4356
Default principal: [email protected]
Valid starting     Expires            Service principal
05/12/18 20:17:22  05/13/18 06:17:22  krbtgt/[email protected]
        renew until 05/19/18 20:17:22

I use my own krb5.config file and like I said before I can use it with java, so I don’t see where is the problem here. My string connection:

conn = connect(host='impala/[email protected], port=21050, auth_mechanism='GSSAPI', user='xx', password='xx', database = 'xx', kerberos_service_name='impala')

I have always the same problem:

File conexionsimple.py", line 18, in <module>     protocol=None)
  File dbapi.py", line 147, in connect  auth_mechanism=auth_mechanism)
  File hiveserver2.py", line 758, in connect  transport.open()
  File python2.7/site-packages/thrift_sasl/__init__.py", line 68, in open    self._trans.open()
  File /thrift/transport/TSocket.py", line 101, in open     message=message)
thrift.transport.TTransport.TTransportException: Could not connect to impala/[email protected]:21050

versions:

python 2.7.14
thrift 0.9.3
thrift-sasl 0.3
sasl 0.2
impyla 0.14

I tried with other thrift version (0.2.1) but I had the same error. Any suggestion?

2 Answers 2

0

Host should be just host name. Remove part up to @ in your example.

Also remove user and password. Kerberos uses kerberos ticket for authentication

1
  • Thanks for the response Tagar, but nothing happen. I have to close with ctr+c or print an exception :(
    – almagr
    May 14, 2018 at 6:28
0

To answer this more fully, kerberos makes impyla more picky than say impala-shell, so the hostname parameter must be the fully qualified domain name of the node running impala, that is registed with kerberos.

For instance my impala service name is impala.somevalue.somedomain, this works fine with an impala shell AND a plain text Impyla connection. It only breaks when you use auth=GSSAPI. To fix it make sure host is the FQDN.

e.g. my fqdn on a cloud provider is ip-xxx-xxx-xxx-xxx.somevalue.somedomain where xxx are the ip address octets.

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.