Configure Hue to use Kerberos
Creating a Kerberos Principal
Set up the Kerberos principal and keytab file .
Using Kerberos Tickets for Hue
Using the keytab and principal you created in the previous step, complete the following steps:
- Extract the Kerberos ticket from the keytab file.
- Optionally, enable the Kerberos ticket renewer.
Extracting the Kerberos Ticket from the keytab File
To extract the ticket from the keytab file, run the following command (substitute your host and realm for perfnode181.perf.lab@dev-maprtech):
kinit -k -t /opt/mapr/conf/mapr.keytab -c /tmp/hue_krb5_ccache mapr/perfnode181.perf.lab@dev-maprtech
This command extracts the ticket
from mapr.keytab
and copies it
to the path to the Kerberos ticket file used by Hue.
Enabling the Kerberos Ticket Renewer
Kerberos tickets have a default expiration time of 7 days. If you plan to use the Hue Kerberos ticket renewer in your cluster, enable this functionality by making changes to these two files:
-
kdc.conf
(add themax_renewable_life
parameter) -
krb5.conf
(add therenew_lifetime
parameter)
Modifying the hue.ini File
In the kerberos
section of
the hue.ini
file, make the following
changes:
- Supply the path to Hue's kerberos keytab file.
- Supply the kerberos principal name for Hue.
- Supply the path to kinit.
- Complete the following steps in the
[[yarn_clusters]] [[[default]]]
section:- If you are using a certificate signed by the CA (Certificate Authority), set
the
ssl_cert_ca_verify
value toTrue
. - If you are using a self-signed certificate or no certificate, leave the value
set to
False
.
- If you are using a certificate signed by the CA (Certificate Authority), set
the
-
For Hue with secure Hive: In
the
beeswax
section, make sure that thehive_conf_dir
property points to a directory containing a validhive-site.xml
file (either the original or a synced copy). -
For Hue with secure Hive: Provide the fully-qualified domain name (FQDN) for the
hive_server_host
.NOTE: For Hue to work with HiveServer2 with security enabled, you must provide the fully-qualified domain name (FQDN) for thehive_server_host
. This must match the FQDN of thehue_principal
property. -
Optional: To enable SSL encryption, see Enable SSL Encryption Between Hue and Hive.
-
For Oozie only: Set the
oozie_url
parameter in theliboozie
section.NOTE: For Hue to work with Oozie with security enabled, you must provide the URL where the Oozie service is running by setting theoozie_url
parameter in theliboozie
section.
The changes are summarized in the
following hue.ini
files, which you can use
as a template:
[desktop]
[[kerberos]]
# Path to Hue's Kerberos keytab file
hue_keytab=/opt/mapr/conf/mapr.keytab
# Kerberos principal name for Hue
# hue_principal=mapr/<hostname>@<realm>
# Substitute your hostname and realm in the example below
hue_principal=mapr/perfnode181.perf.lab@dev-maprtech
# Path to kinit
# Note that the actual path depends on which Linux OS you are using
kinit_path=/usr/bin/kinit
[beeswax]
# If Kerberos security is enabled, use fully-qualified domain name
# (FQDN)
hive_server_host=<FQDN of Hive Server>
# Hive configuration directory, where hive-site.xml is located.
hive_conf_dir=/opt/mapr/hive/hive-<version>/conf
# Change this if your Hive is secured
security_enabled=true
# Security mechanism of authentication none/GSSAPI/MAPR-SECURITY
mechanism=GSSAPI
[impala]
# Kerberos principal
impala_principal=mapr/perfnode181.perf.lab@dev-maprtech
[hadoop]
...
[[yarn_clusters]]
[[[default]]]
# Enter the host on which you are running the ResourceManager
## resourcemanager_host=localhost
# The port where the ResourceManager IPC listens on
## resourcemanager_port=8032
# Whether to submit jobs to this cluster
submit_to=true
# Change this if your YARN cluster is secured
security_enabled=true
# URL of the ResourceManager API
## resourcemanager_api_url=https://localhost:8090
# URL of the ProxyServer API
## proxy_api_url=https://localhost:8090
# URL of the HistoryServer API
history_server_api_url=https://localhost:19890
# Security mechanism of authentication none/GSSAPI/MAPR-SECURITY
mechanism=GSSAPI
# In secure mode (HTTPS), if SSL certificates from Resource Manager's
# Rest Server have to be verified against certificate authority
ssl_cert_ca_verify=False
[liboozie]
# The URL where the Oozie service runs on. This is required in order for
# users to submit jobs.
oozie_url=http://perfnode181.perf.lab:<oozie_port_number>/oozie
# Requires FQDN in oozie_url if enabled
security_enabled=true
# Security mechanism of authentication none/GSSAPI/MAPR-SECURITY
mechanism=GSSAPI
[hbase]
# Security mechanism of authentication none/GSSAPI/MAPR-SECURITY
mechanism=GSSAPI
security_enabled
property to
true
and mechanism
property to
GSSAPI
for a Kerberised environment. These options are automatically
configured only on a MapR-SASL cluster.Modifying the core-site.xml File
In the core-site.xml
file, provide the shortname for the Kerberos
principal as shown. In addition, verify that you configured the proxyuser during
configuration. See Configure Hue
for details.
<!-- Hue security configuration -->
<property>
<name>hue.kerberos.principal.shortname</name>
<value>mapr</value>
</property>
<property>
<name>hadoop.proxyuser.mapr.groups</name>
<value>*</value> <!-- A group that all users of Hue belong to, or the wildcard value "*" -->
</property>
<property>
<name>hadoop.proxyuser.mapr.hosts</name>
<value><hue_server_FQDN></value>
</property>
Restarting Warden and Hue
After you make all the changes to the files listed above, restart Warden and Hue so the changes will take effect.