title: oozie hive action using hive metastore server with kerberos
body: <p>I'm using CDH5. I have set up a Hive Metastore to use kerberos. i.e. the hive-site.xml has the following properties</p>
  
  <pre><code>&lt;property&gt;
    &lt;name&gt;hive.metastore.sasl.enabled&lt;/name&gt;
    &lt;value&gt;true&lt;/value&gt;
  &lt;/property&gt;
  
  &lt;property&gt;
    &lt;name&gt;hive.metastore.kerberos.keytab.file&lt;/name&gt;
    &lt;value&gt;/etc/hive/conf/hive.keytab&lt;/value&gt;
  &lt;/property&gt;
  
  &lt;property&gt;
    &lt;name&gt;hive.metastore.kerberos.principal&lt;/name&gt;
    &lt;value&gt;hive/hive-metastore.example.com@example.COM&lt;/value&gt;
  &lt;/property&gt;
  </code></pre>
  
  <p>The logs show no errors on starting the hive-metastore service.</p>
  
  <p>I'm trying to run a hive action in an oozie workflow. The oozie-site.xml file has the following property</p>
  
  <pre><code>&lt;property&gt;
    &lt;name&gt;oozie.credentials.credentialclasses&lt;/name&gt;
    &lt;value&gt;hcat=org.apache.oozie.action.hadoop.HCatCredentials&lt;/value&gt;
  &lt;/property&gt;
  </code></pre>
  
  <p>And the workflow xml file has the credentials tag</p>
  
  <pre><code>&lt;credentials&gt;
      &lt;credential name='hive_credentials' type='hcat'&gt;
            &lt;property&gt;
                &lt;name&gt;hcat.metastore.uri&lt;/name&gt;
                &lt;value&gt;thrift://hive-metastore.example.com:9083&lt;/value&gt;
            &lt;/property&gt;
            &lt;property&gt;
                &lt;name&gt;hcat.metastore.principal&lt;/name&gt;
                &lt;value&gt;hive/hadoop-metastore.example.com@example.COM&lt;/value&gt;
            &lt;/property&gt;
       &lt;/credential&gt;
  &lt;/credentials&gt;
  </code></pre>
  
  <p>The hive action refers to the credentials using the 'cred' attribute.</p>
  
  <pre><code>&lt;action name="hive" cred="hive_credentials"&gt;
      &lt;hive xmlns="uri:oozie:hive-action:0.2"&gt;
          &lt;job-tracker&gt;${jobTracker}&lt;/job-tracker&gt;
          &lt;name-node&gt;${nameNode}&lt;/name-node&gt;
          &lt;job-xml&gt;${appPath}/hive-site.xml&lt;/job-xml&gt;
          &lt;configuration&gt;
              &lt;property&gt;
                  &lt;name&gt;mapred.job.queue.name&lt;/name&gt;
                  &lt;value&gt;${queueName}&lt;/value&gt;
              &lt;/property&gt;
          &lt;/configuration&gt;
          &lt;script&gt;${appPath}/queries.hql&lt;/script&gt;
      &lt;/hive&gt;
      &lt;ok to="pass"/&gt;
      &lt;error to="fail"/&gt;
  &lt;/action&gt;
  </code></pre>
  
  <p>When I try to run this workflow, I get the following error.</p>
  
  <pre><code>Exception in addtoJobConf
  MetaException(message:Could not connect to meta store using any of the URIs provided. Most recent failure: org.apache.thrift.transport.TTransportException: No common protection layer between client and server
          at org.apache.thrift.transport.TSaslTransport.sendAndThrowMessage(TSaslTransport.java:221)
          at org.apache.thrift.transport.TSaslTransport.open(TSaslTransport.java:297)
          at org.apache.thrift.transport.TSaslClientTransport.open(TSaslClientTransport.java:37)
          at org.apache.hadoop.hive.thrift.client.TUGIAssumingTransport$1.run(TUGIAssumingTransport.java:52)
          at org.apache.hadoop.hive.thrift.client.TUGIAssumingTransport$1.run(TUGIAssumingTransport.java:49)
          at java.security.AccessController.doPrivileged(Native Method)
          at javax.security.auth.Subject.doAs(Subject.java:396)
          at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1548)
          at org.apache.hadoop.hive.thrift.client.TUGIAssumingTransport.open(TUGIAssumingTransport.java:49)
          at org.apache.hadoop.hive.metastore.HiveMetaStoreClient.open(HiveMetaStoreClient.java:288)
          at org.apache.hadoop.hive.metastore.HiveMetaStoreClient.&lt;init&gt;(HiveMetaStoreClient.java:169)
          at org.apache.hadoop.hive.metastore.HiveMetaStoreClient.&lt;init&gt;(HiveMetaStoreClient.java:109)
          at org.apache.oozie.action.hadoop.HCatCredentialHelper.getHCatClient(HCatCredentialHelper.java:87)
          at org.apache.oozie.action.hadoop.HCatCredentialHelper.set(HCatCredentialHelper.java:52)
          at org.apache.oozie.action.hadoop.HCatCredentials.addtoJobConf(HCatCredentials.java:58)
          at org.apache.oozie.action.hadoop.JavaActionExecutor.setCredentialTokens(JavaActionExecutor.java:990)
          at org.apache.oozie.action.hadoop.JavaActionExecutor.submitLauncher(JavaActionExecutor.java:851)
          at org.apache.oozie.action.hadoop.JavaActionExecutor.start(JavaActionExecutor.java:1071)
          at org.apache.oozie.command.wf.ActionStartXCommand.execute(ActionStartXCommand.java:217)
          at org.apache.oozie.command.wf.ActionStartXCommand.execute(ActionStartXCommand.java:62)
          at org.apache.oozie.command.XCommand.call(XCommand.java:280)
          at org.apache.oozie.service.CallableQueueService$CompositeCallable.call(CallableQueueService.java:323)
          at org.apache.oozie.service.CallableQueueService$CompositeCallable.call(CallableQueueService.java:252)
          at org.apache.oozie.service.CallableQueueService$CallableWrapper.run(CallableQueueService.java:174)
          at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:895)
          at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:918)
          at java.lang.Thread.run(Thread.java:662)
  )
          at org.apache.hadoop.hive.metastore.HiveMetaStoreClient.open(HiveMetaStoreClient.java:334)
          at org.apache.hadoop.hive.metastore.HiveMetaStoreClient.&lt;init&gt;(HiveMetaStoreClient.java:169)
          at org.apache.hadoop.hive.metastore.HiveMetaStoreClient.&lt;init&gt;(HiveMetaStoreClient.java:109)
          at org.apache.oozie.action.hadoop.HCatCredentialHelper.getHCatClient(HCatCredentialHelper.java:87)
          at org.apache.oozie.action.hadoop.HCatCredentialHelper.set(HCatCredentialHelper.java:52)
          at org.apache.oozie.action.hadoop.HCatCredentials.addtoJobConf(HCatCredentials.java:58)
          at org.apache.oozie.action.hadoop.JavaActionExecutor.setCredentialTokens(JavaActionExecutor.java:990)
          at org.apache.oozie.action.hadoop.JavaActionExecutor.submitLauncher(JavaActionExecutor.java:851)
          at org.apache.oozie.action.hadoop.JavaActionExecutor.start(JavaActionExecutor.java:1071)
          at org.apache.oozie.command.wf.ActionStartXCommand.execute(ActionStartXCommand.java:217)
          at org.apache.oozie.command.wf.ActionStartXCommand.execute(ActionStartXCommand.java:62)
          at org.apache.oozie.command.XCommand.call(XCommand.java:280)
          at org.apache.oozie.service.CallableQueueService$CompositeCallable.call(CallableQueueService.java:323)
          at org.apache.oozie.service.CallableQueueService$CompositeCallable.call(CallableQueueService.java:252)
          at org.apache.oozie.service.CallableQueueService$CallableWrapper.run(CallableQueueService.java:174)
          at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:895)
          at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:918)
          at java.lang.Thread.run(Thread.java:662)
  </code></pre>
  
  <p>Any idea what could be causing this issue?</p>