Configuring Drill-on-Yarn on a Secure Cluster

Describes how to enable SASL for Drill and SQLLine to run Drill-on-YARN in a secure cluster.

About this task

Update the drill_home/conf/distrib-env.sh file with the required options. If you use --site, then use your site directory.

The following options are requried for Drill and SQLLine to work with SASL security:

-Ddrill.customAuthFactories=org.apache.drill.exec.rpc.security.maprsasl.MapRSaslFactory 
-Dzookeeper.sasl.client=true 
-Djava.security.auth.login.config=/opt/mapr/conf/mapr.login.conf
-Dzookeeper.saslprovider=com.mapr.security.maprsasl.MaprSaslProvider
-Dhadoop.login=hybrid_keytab

The following sections describe how to update the drill_home/conf/distrib-env.sh file with the options to ensure that Drill and SQLLine work with SASL for security.

Drill

To make Drill work with SASL, set DRILL_JAVA_OPTS as shown:

export DRILL_JAVA_OPTS="${DRILL_JAVA_OPTS} -Ddrill.customAuthFactories=org.apache.drill.exec.rpc.security.maprsasl.MapRSaslFactory -Dzookeeper.sasl.client=true -Djava.security.auth.login.config=/opt/mapr/conf/mapr.login.conf -Dzookeeper.saslprovider=com.mapr.security.maprsasl.MaprSaslProvider -Dhadoop.login=hybrid_keytab"

SQLLine

To make SQLLine work with SASL, set SQLLINE_JAVA_OPTS as shown:

export SQLLINE_JAVA_OPTS="${SQLLINE_JAVA_OPTS} -Ddrill.customAuthFactories=org.apache.drill.exec.rpc.security.maprsasl.MapRSaslFactory -Dzookeeper.sasl.client=true -Djava.security.auth.login.config=/opt/mapr/conf/mapr.login.conf -Dzookeeper.saslprovider=com.mapr.security.maprsasl.MaprSaslProvider"

TIP The following table describes each of the options:

Option	Description
drill.customAuthFactories	Required to make Drill and SQLLine work with SASL. It points to the authentication factories used for authentication. Provides a full classpath to the SASL implementation.
zookeeper.sasl.client	Required to make Drill and SQLLine work with Zookeeper in a SASL-enabled environment and ZooKeeper client authentication. It enables or disables SASL authentication in Drill and SQLLine for ZooKeeper connections.
zookeeper.saslprovider	Required to make Drill and SQLLine work with ZooKeeper in a SASL-enabled environement and ZooKeeper client authentication. It points to the authentication factories used for authentication in Drill and SQLLine for ZooKeeper connections. Provides a full classpath to the SASL implementation.
java.security.auth.login.config	Required to make Drill and SQLLine work with security. It points to a file with JAAS configurations. In the HPE environment it is `/opt/mapr/conf/mapr.login.conf`.
hadoop.login=hybrid_keytab	Required to make Drill work with SASL security. It points to the required JAAS configuration name.