无Kerberos的Windows服务器连接Kerberos认证CDH Hive失败求助

环境信息 #

• Python版本：3.9.7（Conda环境）
• Pyhive版本：0.6.5
• 场景：未安装Kerberos客户端的Windows服务器，需连接开启MIT Kerberos认证的Cloudera Hadoop Hive服务

已尝试的操作 #

• 从Cloudera服务器复制krb5.conf和keytab文件到本地，将krb5.conf重命名为krb5.ini
• 在Python脚本中配置环境变量并发起连接：

from pyhive import hive
import os
os.environ['KRB5_CONFIG'] = 'PATH\TO\krb5.ini'
os.environ['KRB5_CLIENT_KTNAME'] = 'PATH\TO\hive.service.keytab'

conn = hive.Connection(host="some-ip-address", port=4202, auth='KERBEROS', kerberos_service_name='hive')

• 移除环境变量配置后重试，报错信息无变化
• 尝试通过Pyhive Connection的configuration参数配置两种不同的参数组合，均无效：

config1={
    'hive.metastore.client.principal':'MYNAME@HADOOP.COM',
    'hive.metastore.sasl.enabled': 'true',
    'hive.metastore.client.keytab': 'PATH\\TO\\keytab',
}
hiveconn=hive.Connection(host="some-ip",port=4202, auth='KERBEROS', kerberos_service_name='hive', configuration=config1)

config2={
    'hive.server2.authentication.kerberos.principal':'MYNAME@HADOOP.COM',
    'hive.server2.authentication.kerberos.keytab': 'PATH\\TO\\keytab',
}
hiveconn=hive.Connection(host="some-ip",port=4202, auth='KERBEROS', kerberos_service_name='hive', configuration=config2)

报错信息 #

(myenv) C:\Users\myname\Desktop>python hivetest.py
Traceback (most recent call last):
  File "C:\Users\myname\Desktop\hivetest.py", line 34, in <module>
    hiveconn=hive.Connection(host="some-ip-address",port=4202, auth='KERBEROS', kerberos_service_name='hive')
  File "C:\Users\myname\AppData\Local\conda\conda\envs\myenv\lib\site-packages\pyhive\hive.py", line 243, in __init__
    self._transport.open()
  File "C:\Users\myname\AppData\Local\conda\conda\envs\myenv\lib\site-packages\thrift_sasl\__init__.py", line 84, in open
    raise TTransportException(type=TTransportException.NOT_OPEN,
thrift.transport.TTransport.TTransportException: Could not start SASL: b'Error in sasl_client_start (-4) SASL(-4): no mechanism available: Unable to find a callback: 2'

历史正常连接情况 #

Hadoop服务器未开启Kerberos认证时，使用以下代码可正常连接：

conn = hive.Connection(host="ip-address", port=4202, username="some-user", auth="NONE")

疑问 #

• 连接的前置条件是否存在错误？
• 连接Kerberos认证的Hadoop服务器是否必须安装Kerberos客户端？

内容的提问来源于stack exchange，提问作者protokoul