How To Connect Cloudera (CDH3u4) With Tableau Using Secure Beeswax Mode

From Tableau version 7.0.9 to 8.1, you can use the Tableau Cloudera Hadoop connector to connect to your Hadoop data using the new secure Beeswax server in CDH3u4. Additionally, connection to a Beeswax server allows multiple users to access Hadoop data at the same time. This article covers the set up required on the Tableau client machine to connect to a Beeswax server in secure mode. Contact your Cloudera support representative to assist you with the server-side set up that may be required on the Cloudera Hadoop cluster.

Before you can connect to a Beeswax server in secure mode, additional software and configuration is required on the client machine where Tableau is installed. Version 1.2 of the Cloudera ODBC driver and a Kerberos utility must be installed. The Kerberos utility will be used to generate a ticket that the ODBC driver will use to authenticate and allow you to connect to the secure Beeswax server.

To set up and use Kerberos, you will need to first perform the following tasks. Then, use the steps outlined below as a guideline to set up Kerberos on your machine and connect to a secure Beeswax server. These steps may vary depending on your environment and configuration. 
  • Install Tableau 7.0.9 - 8.1
  • Install ODBC v1.2 driver: Download and install the Cloudera ODBC v1.2 driver. A link to the Cloudera website is provided on the Drivers page.
  • Download and install MIT Kerberos for Windows 3.2.2: Download this tool from the MIT website - http://web.mit.edu/kerberos/dist/index.html#kfw-3.2 .
  • Add Kerberos to Path environment variable: Add the Kerberos directory to the Path environment variable. For example, if Kerberos is installed on the C drive in C:\Program Files (x86)\MIT\Kerberos\bin, then the Path variable should include:  C:\Program Files (x86)\MIT\Kerberos\bin.
  • Obtain .keytab file: Obtain a .keytab file from the IT administrator, and save it to a location on your machine that you can later reference. This .keytab file is necessary for you to generate a Kerberos ticket.
Important: Tableau does not support or test the Kerberos utility. This article is intended to provide general guidance on configuring Kerberos to generate a ticket and authenticate Tableau so that you can connect to a secure Beeswax server.

Step 1

From the Start menu, open the Kerberos Network Identity Manager, and select Options > General.

Step 2

In the navigation pane, under Kerberos v5, select Realms.

Step 3

In the main pane, double-click , and type the realm name specified by your IT administrator.

Step 4

Select the realm you created in step 3. Under Kerberos Servers, double-click , and type the Kerberos server name specified by your IT administrator.

Step 5

Click the Apply button, click the OK button, and then select File > Exit.

Step 6

Open the Command Prompt with administrator privileges, and navigate to the “bin” folder in the Kerberos directory. For example, type: cd C:\Program Files (x86)\MIT\Kerberos\bin

Step 7

Type the following command: kinit -k -t

Note: Replace  with the full path and name of your .keytab file, and replace  with your Kerberos username. For example: kinit –k –t c:\bw.keytab bw/krbtest@KRBTEST-LOCAL

Step 8

Type the following command to verify you have generated a Kerberos ticket: klist

Note: You can identify your ticket by the time stamp.

Step 9

Launch Tableau from the same Command Prompt window. For example, type: “C:\Program Files(x86)\Tableau\Tableau 7.0\bin\tableau.exe”

Step 10

From the Connect to Data page, select Cloudera Hadoop.

Step 11

Follow the steps in the Cloudera Hadoop Hive Connection dialog box to complete the connection. Make sure you select the Beeswax Server and Kerberos option under Step 2 in the dialog box to connect to the secure Beeswax server.

Note: Selecting the Beeswax Server option will connect to the Beeswax server without Kerberos authentication. Alternate Search Terms:hive, concurrency, odbc