Hive service and HBase service are deployed on a FusionInsight cluster, and two apps (applications) are deployed on Tomcat. One app is to access the HBase service, and the other app is to access the…

Question

Options

• AJust do authentication on the app that accesses the HBase service
• BJust do authentication on the app that accesses the Hive service.
• CCombine these two apps into one and do authentication on the new app
• DDeploy these two apps to two independent Tomcats, and then authenticate each

• A
  20% (7)
• B
  9% (3)
• C
  71% (25)

Explanation

In FusionInsight's security model, a single Tomcat JVM instance can only maintain one active Kerberos authentication context at a time. When two apps with separate authentication requirements share the same Tomcat, their credential contexts conflict, making independent authentication for each app impossible in the same process.

C is correct because merging both apps into one creates a single authentication context that covers both HBase and Hive access - eliminating the conflict entirely within the shared JVM.

D is correct because separating the apps into two independent Tomcat instances gives each its own JVM, meaning each can maintain its own Kerberos context and authenticate independently without interference.

A is wrong because skipping authentication on the Hive app leaves it unsecured - both services require authentication in a Kerberos-enabled cluster.

B is wrong for the same reason in reverse - the HBase app also requires its own authentication; you cannot omit it.

Memory tip: Think "one JVM, one Kerberos ticket." If two apps must coexist in the same Tomcat, merge them (one ticket covers both). If they must stay separate, split Tomcats so each gets its own JVM and its own ticket.

No community discussion yet for this question.