You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@paimon.apache.org by "tyoushinya (via GitHub)" <gi...@apache.org> on 2026/08/08 08:52:14 UTC
[I] [Bug] Exception when reading Paimon table via Hive proxy user in Kerberos-enabled environment [paimon]
tyoushinya opened a new issue, #9113:
URL: https://github.com/apache/paimon/issues/9113
### Search before asking
- [x] I searched in the [issues](https://github.com/apache/paimon/issues) and found nothing similar.
### Paimon version
1. Create a Paimon table and insert data using Flink/Spark engine.
2. In a Kerberos-enabled Hive environment, use a proxy user (different from the HiveServer2 user) to read data from the Paimon table.
3. An exception is thrown regardless of whether paimon.security.kerberos.login.keytab and paimon.security.kerberos.login.principal are configured or not.
<img width="846" height="130" alt="Image" src="https://github.com/user-attachments/assets/d4442723-94eb-4d64-bf58-d5754f6ff43f" />
hive server2 log:
2026-08-08T16:24:19,654 INFO [59d47da6-ceaa-4799-8577-5f5da8d50fd4 HiveServer2-Handler-Pool: Thread-103]: session.SessionState (:()) - Resetting thread name to HiveServer2-Handler-Pool: Thread-103
2026-08-08T16:24:19,655 WARN [HiveServer2-Handler-Pool: Thread-103]: thrift.ThriftCLIService (:()) - Error executing statement:
org.apache.hive.service.cli.HiveSQLException: Error while compiling statement: FAILED: SemanticException Proxy user is not supported
at org.apache.hive.service.cli.operation.Operation.toSQLException(Operation.java:335) ~[hive-service-3.1.0.3.1.0.0-78.jar:3.1.0.3.1.0.0-78]
at org.apache.hive.service.cli.operation.SQLOperation.prepare(SQLOperation.java:199) ~[hive-service-3.1.0.3.1.0.0-78.jar:3.1.0.3.1.0.0-78]
at org.apache.hive.service.cli.operation.SQLOperation.runInternal(SQLOperation.java:262) ~[hive-service-3.1.0.3.1.0.0-78.jar:3.1.0.3.1.0.0-78]
at org.apache.hive.service.cli.operation.Operation.run(Operation.java:247) ~[hive-service-3.1.0.3.1.0.0-78.jar:3.1.0.3.1.0.0-78]
at org.apache.hive.service.cli.session.HiveSessionImpl.executeStatementInternal(HiveSessionImpl.java:575) ~[hive-service-3.1.0.3.1.0.0-78.jar:3.1.0.3.1.0.0-78]
at org.apache.hive.service.cli.session.HiveSessionImpl.executeStatementAsync(HiveSessionImpl.java:561) ~[hive-service-3.1.0.3.1.0.0-78.jar:3.1.0.3.1.0.0-78]
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_271]
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_271]
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_271]
at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_271]
at org.apache.hive.service.cli.session.HiveSessionProxy.invoke(HiveSessionProxy.java:78) ~[hive-service-3.1.0.3.1.0.0-78.jar:3.1.0.3.1.0.0-78]
at org.apache.hive.service.cli.session.HiveSessionProxy.access$000(HiveSessionProxy.java:36) ~[hive-service-3.1.0.3.1.0.0-78.jar:3.1.0.3.1.0.0-78]
at org.apache.hive.service.cli.session.HiveSessionProxy$1.run(HiveSessionProxy.java:63) ~[hive-service-3.1.0.3.1.0.0-78.jar:3.1.0.3.1.0.0-78]
at java.security.AccessController.doPrivileged(Native Method) ~[?:1.8.0_271]
at javax.security.auth.Subject.doAs(Subject.java:422) ~[?:1.8.0_271]
at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1730) ~[hadoop-common-3.1.1.3.1.0.0-78.jar:?]
at org.apache.hive.service.cli.session.HiveSessionProxy.invoke(HiveSessionProxy.java:59) ~[hive-service-3.1.0.3.1.0.0-78.jar:3.1.0.3.1.0.0-78]
at com.sun.proxy.$Proxy72.executeStatementAsync(Unknown Source) ~[?:?]
at org.apache.hive.service.cli.CLIService.executeStatementAsync(CLIService.java:315) ~[hive-service-3.1.0.3.1.0.0-78.jar:3.1.0.3.1.0.0-78]
at org.apache.hive.service.cli.thrift.ThriftCLIService.ExecuteStatement(ThriftCLIService.java:566) ~[hive-service-3.1.0.3.1.0.0-78.jar:3.1.0.3.1.0.0-78]
at org.apache.hive.service.rpc.thrift.TCLIService$Processor$ExecuteStatement.getResult(TCLIService.java:1557) ~[hive-exec-3.1.0.3.1.0.0-78.jar:3.1.0.3.1.0.0-78]
at org.apache.hive.service.rpc.thrift.TCLIService$Processor$ExecuteStatement.getResult(TCLIService.java:1542) ~[hive-exec-3.1.0.3.1.0.0-78.jar:3.1.0.3.1.0.0-78]
at org.apache.thrift.ProcessFunction.process(ProcessFunction.java:39) ~[hive-exec-3.1.0.3.1.0.0-78.jar:3.1.0.3.1.0.0-78]
at org.apache.thrift.TBaseProcessor.process(TBaseProcessor.java:39) ~[hive-exec-3.1.0.3.1.0.0-78.jar:3.1.0.3.1.0.0-78]
at org.apache.hadoop.hive.metastore.security.HadoopThriftAuthBridge$Server$TUGIAssumingProcessor.process(HadoopThriftAuthBridge.java:647) ~[hive-exec-3.1.0.3.1.0.0-78.jar:3.1.0.3.1.0.0-78]
at org.apache.thrift.server.TThreadPoolServer$WorkerProcess.run(TThreadPoolServer.java:286) ~[hive-exec-3.1.0.3.1.0.0-78.jar:3.1.0.3.1.0.0-78]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) ~[?:1.8.0_271]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) ~[?:1.8.0_271]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_271]
Caused by: org.apache.hadoop.hive.ql.parse.SemanticException: Proxy user is not supported
at org.apache.hadoop.hive.ql.optimizer.SimpleFetchOptimizer.transform(SimpleFetchOptimizer.java:125) ~[hive-exec-3.1.0.3.1.0.0-78.jar:3.1.0.3.1.0.0-78]
at org.apache.hadoop.hive.ql.optimizer.Optimizer.optimize(Optimizer.java:250) ~[hive-exec-3.1.0.3.1.0.0-78.jar:3.1.0.3.1.0.0-78]
at org.apache.hadoop.hive.ql.parse.SemanticAnalyzer.analyzeInternal(SemanticAnalyzer.java:12423) ~[hive-exec-3.1.0.3.1.0.0-78.jar:3.1.0.3.1.0.0-78]
at org.apache.hadoop.hive.ql.parse.CalcitePlanner.analyzeInternal(CalcitePlanner.java:360) ~[hive-exec-3.1.0.3.1.0.0-78.jar:3.1.0.3.1.0.0-78]
at org.apache.hadoop.hive.ql.parse.BaseSemanticAnalyzer.analyze(BaseSemanticAnalyzer.java:289) ~[hive-exec-3.1.0.3.1.0.0-78.jar:3.1.0.3.1.0.0-78]
at org.apache.hadoop.hive.ql.Driver.compile(Driver.java:664) ~[hive-exec-3.1.0.3.1.0.0-78.jar:3.1.0.3.1.0.0-78]
at org.apache.hadoop.hive.ql.Driver.compileInternal(Driver.java:1869) ~[hive-exec-3.1.0.3.1.0.0-78.jar:3.1.0.3.1.0.0-78]
at org.apache.hadoop.hive.ql.Driver.compileAndRespond(Driver.java:1816) ~[hive-exec-3.1.0.3.1.0.0-78.jar:3.1.0.3.1.0.0-78]
at org.apache.hadoop.hive.ql.Driver.compileAndRespond(Driver.java:1811) ~[hive-exec-3.1.0.3.1.0.0-78.jar:3.1.0.3.1.0.0-78]
at org.apache.hadoop.hive.ql.reexec.ReExecDriver.compileAndRespond(ReExecDriver.java:126) ~[hive-exec-3.1.0.3.1.0.0-78.jar:3.1.0.3.1.0.0-78]
at org.apache.hive.service.cli.operation.SQLOperation.prepare(SQLOperation.java:197) ~[hive-service-3.1.0.3.1.0.0-78.jar:3.1.0.3.1.0.0-78]
... 27 more
Caused by: java.lang.UnsupportedOperationException: Proxy user is not supported
at org.apache.paimon.security.KerberosLoginProvider.throwProxyUserNotSupported(KerberosLoginProvider.java:103) ~[paimon-hive-connector-3.1-1.3.2.jar:1.3.2]
at org.apache.paimon.security.KerberosLoginProvider.isLoginPossible(KerberosLoginProvider.java:76) ~[paimon-hive-connector-3.1-1.3.2.jar:1.3.2]
at org.apache.paimon.security.HadoopModule.install(HadoopModule.java:55) ~[paimon-hive-connector-3.1-1.3.2.jar:1.3.2]
at org.apache.paimon.fs.hadoop.HadoopSecuredFileSystem.trySecureFileSystem(HadoopSecuredFileSystem.java:205) ~[paimon-hive-connector-3.1-1.3.2.jar:1.3.2]
### Compute Engine
Paimon 1.3.2
Hive 3.1.0
HDFS 3.1.1
### Minimal reproduce step
1. Create a Paimon table and insert data using Flink/Spark engine.
2. In a Kerberos-enabled Hive environment, use a proxy user (different from the HiveServer2 user) to read data from the Paimon table.
3. An exception is thrown regardless of whether paimon.security.kerberos.login.keytab and paimon.security.kerberos.login.principal are configured or not.
### What doesn't meet your expectations?
No data return, got exception.
### Anything else?
_No response_
### Are you willing to submit a PR?
- [x] I'm willing to submit a PR!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@paimon.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] Exception when reading Paimon table via Hive proxy user in Kerberos-enabled environment [paimon]
Posted by "JingsongLi (via GitHub)" <gi...@apache.org>.
JingsongLi closed issue #9113: [Bug] Exception when reading Paimon table via Hive proxy user in Kerberos-enabled environment
URL: https://github.com/apache/paimon/issues/9113
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@paimon.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org