Authentication Configuration

This operation enables you to configure the authentication mode to access the HDFS service of a namespace.

Prerequisites

Procedure

  1. Choose Resources > Resources > Namespace.
  2. Select the desired account from the Account drop-down list in the upper left corner.
  3. Click the name of a desired namespace. On the details page that is displayed, choose Protocol > HDFS.
  4. Click Configure Authentication.

    The Configure Authentication page is displayed.

  5. Select an authentication mode. Possible values are:

    • none: Interconnection is not required.
    • ranger: Select this option when the HDFS service is interconnected with Hortonworks HDP.

      Set the parameters related to ranger authentication, as shown in.

      Table 1 Ranger authentication parameters

      Parameter

      Description

      Service Name

      Indicates an HDFS service name configured on the Ranger.

      NOTE:
      • A service name can contain a maximum of 50 characters.
      • The service name can contain only letters, digits, underscores (_), and hyphens (-).

      Ranger URL

      Indicates a Ranger Admin address.

      Interval (ms)

      Indicates a period for obtaining a policy. The default value is 30000 ms.

      NOTE:

      The value ranges from 1000 ms to 120000 ms.

      Cache Policy

      Indicates whether to clear the local cache when rangerurl can be connected but the corresponding service name cannot be found. By default, Do not use cache is selected. You are advised not to use the cache.

      KeyStore File

      Indicates the keystore file required for SSL communication.

      NOTE:

      The file needs to be uploaded when SSL is configured for the Ranger service.

      KeyStore Key File

      Indicates the keystore password file.

      NOTE:

      The file needs to be uploaded when SSL is configured for the Ranger service.

      TrustStore File

      Specifies the truststore file required for SSL communication.

      NOTE:

      The file needs to be uploaded when SSL is configured for the Ranger service.

      TrustStore Key File

      Specifies the truststore password file.

      NOTE:

      The file needs to be uploaded when SSL is configured for the Ranger service.
    • sentry: Select this option when the HDFS service is interconnected with Cloudera CDH.
      Set parameters related to sentry authentication, as shown in Table 2.
      Table 2 Sentry authentication parameters

      Parameter

      Description

      Sentry Address

      Address of the Sentry server. The value is the same as the value of sentry.hdfs.service.client.server.rpc-addresses in CDH configuration file hdfs-site.xml. The format is IP address:Port number (optional). Replace the Sentry host name with the actual IP address.

      NOTE:

      The configuration of multiple Sentry addresses is not supported. If there are multiple Sentry addresses on the CDH computing side, only one Sentry address can be configured.

      Sentry Port

      Port number of the Sentry server. The value is the same as the value of sentry.hdfs.service.client.server.rpc-port in CDH configuration file hdfs-site.xml.

      Security Style

      The security mode can be kerberos or simple. Set this parameter based on the security mode used by the CDH client.

      Keytab File

      Indicates the .keytab file generated by the Kerberos user created on the Kerberos service.

      NOTE:

      If the security mode is kerberos, you need to upload the file.

      Principal

      Principal of the sentry service. CDH5.14.4 is used as an example. Log in to the CDH management page, choose Administration > Security > Kerberos Credentials, enter sentry in the search box, and obtain the principal part, that is, the value of Principal.

      NOTE:

      If the security mode is kerberos, you need to upload the file.

      Interval (ms)

      Synchronization period of the sentry permission. The unit is ms. The value ranges from 500 to 30000.

      Local Cache Expiration Duration (ms)

      Expiration time of the local cache. It is recommended that the value be greater than the period. The unit is ms. The value ranges from 500 to 120000.

      Path Prefix

      Sentry permission control directory. The default value is /user/hive/warehouse.

      Connected CDH Version

      Possible options are CDH5.16 or later and Earlier than CDH 5.16.

  6. Click OK.
  7. Confirm your operation as prompted.
Parent topic: Managing Namespaces