Apache Hive : Setting Up OAuth 2 with Keycloak

Keycloak Settings

1. Register Hive Metastore as a Resource Server

Browse Manage -> Clients -> Create client, and create a client for HMS, as an OAuth 2 resource server. This example useshive-metastore as a client ID. You can access the client secret in the Credentials tab.

2. Define the “catalog” scope

Iceberg REST Catalog uses “catalog” as the default scope name.

Browse Manage -> Client scopes -> Create client scope, and create the scope. The Name must be catalog and Include in token scope must be enabled.

Then, access the Mappers tab, click Configure a new mapper, choose Audience, and set up a protocol mapper to configure the aud claim of access tokens. The value of Included Client Audience must be hive-metastore.

3. Create Hive Metastore clients

Say that we configure Trino as a REST client.

Browse Manage -> Clients -> Create client, and create a client for Trino, as an OAuth 2 client. You must enable Service accounts roles.

Access the Client scopes tab, click Add client scope, check catalog, and add it as an Optional scope.

Optionally, you can add a custom claim, which is useful to resolve a user name. Let’s add hive-client-username to the service account so that HMS can use it as a username later. Access trino-dedicated in the Client scopes tab, proceed with Configure a new mapper, choose Hardcoded claim, and add a protocol mapper.

Access the Advanced tab, and enable Use "at+jwt" as access token header type. Hive expects an Authorization Server to respect RFC 9068.

You can access the client secret in the Credentials tab.

Application Settings

Hive Metastore

You will add the following parameters in your metastore-site.conf.

You also have to configure the following parameters when you use metastore.catalog.servlet.auth.oauth2.validation.method=introspection.

Trino

You will configure the following parameters for the REST catalog.