Is it possible to run on kerberos-hadoop without kyuubi-kerberos?

[smokeriu]

The documentation says that if the hadoop cluster has kerberos enabled, kyuubi recommends enabling kerberos as well.

But even though the text shows it as a recommendation, in actual deployment, I found it to be a necessity.

once kyuubi opens kerberos, when connecting via hive-jdbc, all user information is bound to kerberos.

I would like the client to be able to use a self-managed user system when connecting to kyuubi, rather than using kerberos. In this case, the kerberos user simply acts as the user who submits jobs to Yarn, and the actual user is managed by kyuubi.

For example, when connecting to kyuubi using jdbc with user/password, kyuubi always uses our configured serverPrinicpal to interact with kerberos-hadoop.

I've tried this and the latest(1.8.1) version doesn't seem to be able to meet this demand? It's also possible that I'm ignore some documentation, so I'd like to ask a question for advice.

If it's true that it's not supported and I want to implement it on my own, can give me some ideas?

[pan3793]

This feature may help #6003

[smokeriu]

Yes, thanks a lot, with this parameter I can make the user submitting the task always be the kerberos user set in kyuubi-server.

But I have another question, when use kyuubi-hive-jdbc-shaded, is it possible to pass the account password instead of kyuubiClientPrincipal?

[pan3793]

do you mean using username/password with some authN mechanisms like LDAP? If so, yes,
jdbc:kyuubi://host:port/<db>;user=<xxx>&password=<xxx>

[smokeriu]

Yes, that's what I meant.

But my kyuubi has kerberos authentication turned on (as my hadoop cluster has kerberos authentication turned on).

Also, can you direct me to the exact documentation, I can't seem to find the exact location of the documentation.

Thanks.