Connection URLs for Kerberos using JDBC Drivers to connect via SQLLine

Client Credentials

A client can provide its credentials in two ways:

• With a ticket granting ticket (TGT) generated on client side. The TGT must be present on client node; Drill does not generate the TGT.
• With a keytab file and the client principal provided in the user property of the connection URL.

Configuration Options

Client Encryption

A client can specify that it requires a server with encryption capabilities only by setting the

drill.exec {
 security:  {
      user.auth.enabled: true,
      auth.mechanisms: ["KERBEROS"],
      auth.principal: "drill/serverhostname@REALM.COM",
      auth.keytab: "/etc/drill/conf/drill.keytab",
      user.encryption.sasl.enabled: true
          }
}

Connection URL Examples

The following five examples show the JDBC connection URL that the embedded JDBC client uses for Kerberos authentication. The first section, Example of a Simple Connection URL, includes a simple connection string and the second section, Examples of Connection URLs Used with Previously Generated TGTs, includes examples to use with previously generated TGTs.

Example of a Simple Connection URL

Example 1: TGT for Client Credentials

jdbc:drill:drillbit=10.10.10.10;principal=<principal for host 10.10.10.10>

In this example, the Drill client uses the:

• Default service_name, which is drill.
• service_host from the Drillbit name provided in the connection URL, which is 10.10.10.10.

The service principal format is <primary>/<instance>@<realm from TGT>. The service principal is principal for host 10.10.10.10.

Examples of Connection URLs Used with Previously Generated TGTs

If you do not provide a service principal in the connection string when using Kerberos authentication, then use the service_name or service_host parameters. Since these parameters are optional, their default values will be used internally (if not provided) to create a valid principal.

Example 2: Drillbit Provided by Direct Connection String and Configured with a Unique Service Principal

This type of connection string is used when:

• Each Drillbit in the cluster is configured with its own service principal.

• The instance component is the host address of the Drillbit.

  jdbc:drill:drillbit=host1;auth=kerberos

In this example, the Drill client uses the:

• Default service_name, which is drill.
• service_host, which is the Drillbit name provided in the connection URL (host1).

The internally created service principal will be drill/host1@<realm from TGT>.

Example 3: Drillbit Selected by ZooKeeper and Configured with Unique Service Principal

jdbc:drill:zk=host01.aws.lab:5181;auth=kerberos;service_name=myDrill

In this example, the Drill client uses the:

• Provided service_name, which is myDrill as the primary name of the principal.
• service_host as the address of the Drillbit, which is chosen from the list of active drillbits that ZooKeeper provides (host01.aws.lab:5181).

The internally created service principal will be myDrill/<host address from zk>@<realm from TGT>.

Example 4: Drillbit Selected by Zookeeper and Configured with a Common Service Principal

jdbc:drill:zk=host01.aws.lab:5181;auth=kerberos;service_name=myDrill;service_host=myDrillCluster

In this example, the Drill client uses the:

• Provided service_name, which is myDrill.
• service_host, which is myDrillCluster.

The internally created service principal, which will be myDrill/myDrillCluster@<realm from TGT>.

Example 5: Keytab for Client Credentials

jdbc:drill:zk=host01.aws.lab:5181;auth=kerberos;service_name=myDrill;service_host=myDrillCluster;keytab=<path to keytab file>;user=<client principal>

In this example, the Drill client:

• Will authenticate itself with the:
  • Keytab (path to keytab file) and
  • Principal provided in the user parameter (client principal)
• Uses the:
  • Provided service_name, which is myDrill.
  • service_host, which is myDrillCluster.

The internally created service principal will be myDrill/myDrillCluster@<realm from krb5.conf>.