When we execute explore query in a secure Hadoop cluster on HDP 2.6.x, it fails with the following exception. This is because HDP 2.6.x has Hive ATSHook enabled by default, and CDAP Master does not pass the delegation token from the Timeline server to the Explore container.
Fixed CDAP to work with and publish to Yarn Timeline Server in a secure environment.
To disable the ATKHook, set the value for the following three configurations to a single space ' '.
Edit: This didn't seem to fix the issue. After we set 'yarn.timeline-service.enabled' to false, then we were able to avoid this issue in a Kerberos-enabled environment.
With ATSHook enabled (default in Ambari 2.6+), I see the following in the explore logs: