## Set up Hive

URL: https://docs.atlan.com/apps/connectors/database/hive/how-tos/set-up-hive

> Configure permissions and authentication for Hive to enable metadata extraction in Atlan.

:::warning Who can do this?
 You need your Hadoop administrator to run these commands.
:::

Configure authentication and permissions for Atlan to connect to your Hive database and extract metadata.

## Choose authentication mechanism

Atlan supports the following authentication mechanisms for Hive. Choose one and configure it according to the steps below.

### Basic authentication

Use basic authentication for development environments or when Kerberos infrastructure isn't available. For production environments, Kerberos authentication is recommended.

### Create user

Hive doesn't provide a built-in command to create users. User creation depends on how HiveServer2 is configured (operating system, LDAP, or custom authentication). When HiveServer2 uses OS-level authentication, create a Linux user to connect to Hive:

```bash
sudo useradd -m atlan_hive_user
sudo passwd atlan_hive_user
```

Replace `atlan_hive_user` with the username for your Atlan connection. For other authentication backends (for example, LDAP), create the user in the appropriate directory or identity store. For details, see [Setting up HiveServer2](https://hive.apache.org/docs/latest/setting-up-hiveserver2_30758712/) in the Apache Hive documentation.

### Kerberos authentication

Kerberos provides secure, ticket-based authentication for production Hive deployments. Use this method when your Hive cluster is configured with Kerberos security.

### Prerequisites

Before configuring Kerberos authentication:

- Your Hive cluster must be configured with Kerberos security enabled
- You need Hadoop administrator privileges to create service principals and generate keytab files

<!-- vale Microsoft.Headings = NO -->

### Create Kerberos principal

<!-- vale Microsoft.Headings = YES -->

Create a dedicated user principal for Atlan to authenticate with Hive:

```bash
kadmin.local -q "addprinc atlan_user@YOUR.REALM"
```

- Replace `YOUR.REALM` with your Kerberos realm name (for example, `ATLAN.LOCAL`)
- The principal format is `username@REALM`

### Generate keytab file

Generate a keytab file for the principal:

```bash
kadmin.local -q "xst -k /path/to/atlan_user.keytab atlan_user@YOUR.REALM"
```

- Replace `/path/to/atlan_user.keytab` with the desired output path
- This creates a binary keytab file containing encrypted Kerberos keys
- Keep this file secure—anyone with this file can authenticate without a password

### Prepare krb5.conf file

Create or obtain a `krb5.conf` file that defines your Kerberos realm and key distribution center (KDC) settings. This file is required for Atlan to authenticate using Kerberos. Typically it includes `[libdefaults]`, `[realms]`, and `[domain_realm]` sections. Use the same `krb5.conf` that your Hive cluster uses, or create one that points to your organization's KDC. Keep the file secure and upload it when configuring the Hive connector in Atlan.

### Test keytab locally

Before uploading to Atlan, verify the keytab works:

```bash
kinit -kt /path/to/atlan_user.keytab atlan_user@YOUR.REALM
klist
```

Verify a valid ticket appears for your principal.

## Grant read permission on objects

Grant read permission on objects with the following commands:

```sql
GRANT SELECT ON DATABASE <database_name> TO USER <username>;
```

Atlan requires read permission for all the objects you want to crawl in Hive.

## Verify configuration

Before proceeding to crawl metadata:

1. Confirm the Hive user has access to the necessary database objects (for example, SELECT on the databases and tables you want to crawl).
2. Validate authentication using the keytab file: run `kinit -kt /path/to/your.keytab principal@REALM` and then connect to HiveServer2 with a Hive client to confirm the credentials work.

## Next steps

Now that you've configured authentication for Hive, you're ready to:
- [Crawl Hive assets](https://docs.atlan.com/llms/connectors/hive/crawl-hive/llms.txt)

---