Disclaimer: This topic includes information about a third-party product. Please note that while we make every effort to keep references to third-party content accurate, the information we provide here might change without notice as Hive/Impala changes. For the most up-to-date information, please consult Hive/Impala documentation and support.
Starting with Tableau Server 10, Tableau Server supports Kerberos delegation to Hive/Impala data sources.
This topic describes how to configure two different authentication approaches with Kerberos between Tableau Server and Hive/Impala.
- Constrained Delegation/Viewer Credentials
- Database Impersonation using Delegation UID
Before you begin
You must configure Tableau Server for Kerberos. For more information see Configure Kerberos.
1. Viewer Credentials/Kerberos Delegation
Before you enable constrained delegation, verify that the Hive/Impala driver that is installed on Tableau Server and that it supports constrained delegation on Windows. With Tableau Server configured, you can use Kerberos for single sign-on (SSO) between Tableau Desktop or a web browser and Tableau Server.
Enabling constrained delegation for Kerberos to Hive/Impala requires you to specify the Tableau Server Run As User for delegation, and add the Hive/Impala services account for delegation in Active Directory. You need to be a domain administrator for your Active Directory domain to do these steps. After configuring Tableau Server for Kerberos, do the following:
Specify the Run As User account for delegation
- On the Active Directory domain controller, start the Active Directory Users and Computers (ADUC) tool.
- In the left pane (Active Directory Domain Services), click Users.
- In the Users pane, right-click the name of the Run As User who will be doing the delegation and then click Properties .
- In the Properties dialog box, in the left pane, select Delegation.
- In the Delegation section, select Trust this user for delegation to specified services only.
- Select Use any authentication protocol.
Add Hive/Impala service accounts for delegation
- To specify the services to be delegated, click Add.
- In the Add Services dialog box, click Add Users or Computers.
- In the text field, type the name of the Hive/Impala service account and then click Check Names. The account should be found.
- Click OK.The SPN (Service Principal Name) list is populated.
- Select the SPNs registered for the Hive/Impala services you want to delegate to.The SPNs should now appear in the SPN list in the delegation section of the properties window for the user.
- Click OK.
When this configuration is complete and Tableau Server users publish workbooks or data sources to the server specifying Viewer Credentials, delegation is done to make the connection to the Hive/Impala data source.
2. Database Impersonation
Database impersonation for Kerberos to Hive/Impala requires you to configure your Hadoop distribution for delegation using the DelegationUID connection parameter.
Before you begin verify that your Tableau Server Run As User account is properly configured:
- The account must be a network account and configured to log into Hive/Impala using Kerberos.
- The account must be granted read access to the Hive/Impala to read queried data.
You should also verify that the Hive/Impala driver that is installed on Tableau Server supports the delegationUID parameter.
Publish using database impersonation
You can publish using database impersonation with one of two methods:
- Embedded credentials—If you do not have a Kerberized cluster, or you have an LDAP frontend, you can embed the credentials for the impersonating user when publishing. The user you connect as when you publish must be configured with the ability to delegate for other users.
- Impersonate with server run as—If you have a Kerberized cluster, you can connect with this option. In this case we will connect as the Tableau Server service user using Kerberos to the backend. The impersonating user, in this case Tableau Server, must be configured with the ability to delegate for other users.
You can validate that database impersonation is configured using the driver manager: