Configuring Spark Thrift Server Encryption

Spark Thrift server encryption is supported when authentication is enabled. You can configure encryption with MapR SASL or with SSL/TLS.

Configuring Encryption with MapR SASL or Kerberos

Starting in EEP 4.0, for secure clusters, you can skip the steps outlined in this section. For new installs done using MapR Installer, the Installer enables this configuration. For manual installs and upgrades, running configure.sh -R enables these settings.

To manually configure encryption with MapR-SASL or Kerberos authentication on a non-secure cluster or in versions earlier than EEP 4.0, complete the following steps:

  1. Set the hive.server2.thrift.sasl.qop property in hive-site.xml to the value auth-conf. The SASL Quality of Protection (QOP), or sasl.qop, setting and the authentication with confidentiality (auth-conf) value support authentication:
    <property>
        <name>hive.server2.thrift.sasl.qop</name>
        <value>auth-conf</value>
    </property>
  2. Restart Spark Thrift server to apply the change:
    IMPORTANT The MapR administrative user (generally, the account named mapr) should start Spark Thrift server. Then, process identifier (PID) files are owned by this user, and impersonation support (where applicable) functions correctly.
    ./sbin/stop-thriftserver.sh
    ./sbin/start-thriftserver.sh

Configuring Encryption with SSL/TLS

To enable encryption with SSL/TLS:
  1. Add the following properties to the /opt/mapr/spark/spark-<version>/conf/spark-defaults.conf file:
    spark.ssl.enabled true
    spark.ssl.fs.enabled true
    spark.ssl.trustStore /opt/mapr/conf/ssl_truststore
    spark.ssl.keyStore /opt/mapr/conf/ssl_keystore
    spark.ssl.protocol TLSv1.2
    spark.ssl.keyStorePassword      mapr123
    spark.ssl.trustStorePassword    mapr123
    After the properties are added, event logs will indicate that the job is encrypted.
  2. To connect using Beeline with encryption, add the following properties to the /opt/mapr/spark/spark-<version>/conf/hive-site.xml file:
    <property>
      <name>hive.server2.use.SSL</name>
      <value>true</value>
      <description>enable/disable SSL </description>
    </property>
    
    <property>
      <name>hive.server2.keystore.path</name>
      <value>/opt/mapr/conf/ssl_keystore</value>
      <description>path to keystore file</description>
    </property>
    
    <property>
      <name>hive.server2.keystore.password</name>
      <value>mapr123</value>
      <description>keystore password</description>
    </property>
  3. To start the Spark Thriftserver, use the following command:
    /opt/mapr/spark/spark-<version>/sbin/start-thriftserver.sh --hiveconf hive.server2.thrift.port=2304 --master yarn --deploy-mode client
    The following example shows a connection string using Beeline (PAM+SSL):
    ./bin/beeline 
    Beeline version 1.2.0-mapr-1808-spark by Apache Hive
    beeline>  !connect jdbc:hive2://node1.cluster.com:2304/default;ssl=true;user=mapr;password=mapr;sslTrustStorePassword=mapr123;sslTrustStore=/opt/mapr/conf/ssl_truststore
    Connecting to jdbc:hive2://node1.cluster.com:2304/default;ssl=true;user=mapr;password=mapr;sslTrustStorePassword=mapr123;sslTrustStore=/opt/mapr/conf/ssl_truststore
    Connected to: Spark SQL (version 2.1.0-mapr-mep-3.x-1808)
    Driver: Hive JDBC (version 1.2.0-mapr-1808-spark)
    Transaction isolation: TRANSACTION_REPEATABLE_READ
    1: jdbc:hive2://node1.cluster.com:2304/defaul>