在開啟Kerberos認證之後，使用者需要進入登入Hive CLI或beeline需要用到keytab。為此，我們現在Kerberos資料庫中建立user1和user2兩個principal。

生成user1和user2的keytab

kadmin.local:  xst -norandkey -k user1.keytab user1
Entry for principal user1 with kvno 1, encryption type aes128-cts-hmac-sha1-96 added to keytab WRFILE:user1.keytab.
Entry for principal user1 with
 
 kvno 1, encryption type des3-cbc-sha1 added to keytab WRFILE:user1.keytab.
Entry for principal user1 with kvno 1, encryption type arcfour-hmac added to keytab WRFILE:user1.keytab.
Entry for principal user1 with kvno 1, encryption type camellia256-cts-cmac added to keytab WRFILE:user1.keytab.
Entry for principal user1 with
 
 kvno 1, encryption type camellia128-cts-cmac added to keytab WRFILE:user1.keytab.
Entry for principal user1 with kvno 1, encryption type des-hmac-sha1 added to keytab WRFILE:user1.keytab.
Entry for principal user1 with kvno 1, encryption type des-cbc-md5 added to keytab WRFILE:user1.keytab.
kadmin.
 
local:  xst -norandkey -k user2.keytab user2
Entry for principal user2 with kvno 1, encryption type aes128-cts-hmac-sha1-96 added to keytab WRFILE:user2.keytab.
Entry for principal user2 with kvno 1, encryption type des3-cbc-sha1 added to keytab WRFILE:user2.keytab.
Entry for principal user2 with kvno 1, encryption type arcfour-hmac added to keytab WRFILE:user2.keytab.
Entry for principal user2 with kvno 1, encryption type camellia256-cts-cmac added to keytab WRFILE:user2.keytab.
Entry for principal user2 with kvno 1, encryption type camellia128-cts-cmac added to keytab WRFILE:user2.keytab.
Entry for principal user2 with kvno 1, encryption type des-hmac-sha1 added to keytab WRFILE:user2.keytab.
Entry for principal user2 with kvno 1, encryption type des-cbc-md5 added to keytab WRFILE:user2.keytab.

由於已經在Hive CLI中建立了db1和db2兩個資料庫，其中在db1建立了table1，在db2中建立了table1和table2，並把db1的角色賦給了user1，db2的角色賦給了user2。這樣user1通過beeline只能看到db1和db1中的table1，同樣user2只能看到db2和db2中的table1和table2。
beeline通過下面語句連線

 beeline -u "jdbc:hive2://hxmaster:10000/;principal=hive/hxmaster@ANDREW.COM"

由於是從本地連線叢集，所以需要將生成的user1.keytab和user2.keytab以及/etc/krb5.conf拷貝到本地隨便一個目錄，這裡選擇”D:/keytab”這個目錄
這樣，我們就可以在本地IntelliJ環境下編寫java程式連線hive了，由於需要用到hive-jdbc和hadoop-client兩個jar包提供執行環境，我們把它們加入到build.sbt檔案中。

libraryDependencies += "org.apache.hive" % "hive-jdbc" % "1.1.0"

libraryDependencies += "org.apache.hadoop" % "hadoop-client" % "2.6.5"

一切就緒，我們就可以通過以下程式碼查詢user1在hive中的表

import org.apache.hadoop.conf.Configuration;
import org.apache.hadoop.security.UserGroupInformation;

import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.PreparedStatement;
import java.sql.ResultSet;

public class KBSimple {
    private static String JDBC_DRIVER = "org.apache.hive.jdbc.HiveDriver";
    private static String CONNECTION_URL ="jdbc:hive2://hxmaster:10000/;principal=hive/[email protected]";

    static {
        try {
            Class.forName(JDBC_DRIVER);

        } catch (ClassNotFoundException e) {
            e.printStackTrace();
        }
    }

    public static void main(String[] args) throws Exception  {
        Class.forName(JDBC_DRIVER);

        //登入Kerberos賬號
        System.setProperty("java.security.krb5.conf", "D:\\keytab\\krb5.conf");

        Configuration configuration = new Configuration();
        configuration.set("hadoop.security.authentication" , "Kerberos" );
        UserGroupInformation. setConfiguration(configuration);
        UserGroupInformation.loginUserFromKeytab("[email protected]",
                "D:\\keytab\\user1.keytab");

        Connection connection = null;
        ResultSet rs = null;
        PreparedStatement ps = null;
        try {
            connection = DriverManager.getConnection(CONNECTION_URL);
            ps = connection.prepareStatement("select * from db1.table1");
            rs = ps.executeQuery();
            while (rs.next()) {
                System.out.println(rs.getString(1));
            }
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

執行結果如下：

同理，查詢一下user2中的table2，程式碼稍作修改

執行結果如下：