title: Connecting to HIVE in Mapper with Kerberos security
body: <p>My goal is to run MapReduce with connection to Hive in Oozie workflow scheduler on secured cluster(kerberos) HDP2.3. </p>
  
  <p>I'm able to connect to hive in beeline or when I run it as java app(yarn jar) with the following connection string:</p>
  
  <pre><code>DriverManager.getConnection("jdbc:hive2://host:10000/;principal=hive/_HOST@REALM", "", "");
  </code></pre>
  
  <p>But when I run it in Mapper it's failed.</p>
  
  <pre><code> ERROR [main] org.apache.thrift.transport.TSaslTransport: SASL negotiation failure
      javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)]
          at com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:212)
          at org.apache.thrift.transport.TSaslClientTransport.handleSaslStartMessage(TSaslClientTransport.java:94)
          at org.apache.thrift.transport.TSaslTransport.open(TSaslTransport.java:253)
          at org.apache.thrift.transport.TSaslClientTransport.open(TSaslClientTransport.java:37)
          at org.apache.hadoop.hive.thrift.client.TUGIAssumingTransport$1.run(TUGIAssumingTransport.java:52)
          at org.apache.hadoop.hive.thrift.client.TUGIAssumingTransport$1.run(TUGIAssumingTransport.java:49)
          at java.security.AccessController.doPrivileged(Native Method)
          at javax.security.auth.Subject.doAs(Subject.java:415)
          at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1657)
          at org.apache.hadoop.hive.thrift.client.TUGIAssumingTransport.open(TUGIAssumingTransport.java:49)
          at org.apache.hive.jdbc.HiveConnection.openTransport(HiveConnection.java:190)
          ...
  Caused by: GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)
          at sun.security.jgss.krb5.Krb5InitCredential.getInstance(Krb5InitCredential.java:147)
          at sun.security.jgss.krb5.Krb5MechFactory.getCredentialElement(Krb5MechFactory.java:121)
          at sun.security.jgss.krb5.Krb5MechFactory.getMechanismContext(Krb5MechFactory.java:187)
          at sun.security.jgss.GSSManagerImpl.getMechanismContext(GSSManagerImpl.java:223)
          at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:212)
          at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:179)
          at com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:193)
  </code></pre>
  
  <p>How to make it working in Mapper?</p>