atlas-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From shweth...@apache.org
Subject incubator-atlas git commit: ATLAS-344 Document HBase permissions for secure cluster (tbeerbower via shwethags)
Date Tue, 01 Dec 2015 06:46:11 GMT
Repository: incubator-atlas
Updated Branches:
  refs/heads/master c9176273b -> 238ca11cd


ATLAS-344 Document HBase permissions for secure cluster (tbeerbower via shwethags)


Project: http://git-wip-us.apache.org/repos/asf/incubator-atlas/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-atlas/commit/238ca11c
Tree: http://git-wip-us.apache.org/repos/asf/incubator-atlas/tree/238ca11c
Diff: http://git-wip-us.apache.org/repos/asf/incubator-atlas/diff/238ca11c

Branch: refs/heads/master
Commit: 238ca11cd5aa65f40616bc347b4b6d4e5964e98a
Parents: c917627
Author: Shwetha GS <sshivalingamurthy@hortonworks.com>
Authored: Tue Dec 1 12:16:02 2015 +0530
Committer: Shwetha GS <sshivalingamurthy@hortonworks.com>
Committed: Tue Dec 1 12:16:02 2015 +0530

----------------------------------------------------------------------
 docs/src/site/twiki/Configuration.twiki | 13 +++++++++++++
 docs/src/site/twiki/index.twiki         |  2 +-
 docs/src/site/twiki/security.twiki      |  2 ++
 release-log.txt                         |  1 +
 4 files changed, 17 insertions(+), 1 deletion(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/incubator-atlas/blob/238ca11c/docs/src/site/twiki/Configuration.twiki
----------------------------------------------------------------------
diff --git a/docs/src/site/twiki/Configuration.twiki b/docs/src/site/twiki/Configuration.twiki
index 63dd725..4a99fcd 100644
--- a/docs/src/site/twiki/Configuration.twiki
+++ b/docs/src/site/twiki/Configuration.twiki
@@ -45,6 +45,19 @@ Advanced configuration
 # If you are planning to use any of the configs mentioned below, they need to be prefixed
with "atlas.graph." to take effect in ATLAS
 Refer http://s3.thinkaurelius.com/docs/titan/0.5.4/titan-config-ref.html#_storage_hbase
 
+Permissions
+
+When Atlas is configured with HBase as the storage backend the graph db (titan) needs sufficient
user permissions to be able to create and access an HBase table.  In a secure cluster it may
be necessary to grant permissions to the 'atlas' user for the 'titan' table.
+
+With Ranger, a policy can be configured for 'titan'.
+
+Without Ranger, HBase shell can be used to set the permissions.
+
+<verbatim>
+   su hbase
+   kinit -k -t <hbase keytab> <hbase principal>
+   echo "grant 'atlas', 'RWXCA', 'titan'" | hbase shell
+</verbatim>
 
 ---++++ Graph Search Index
 This section sets up the graph db - titan - to use an search indexing system. The example

http://git-wip-us.apache.org/repos/asf/incubator-atlas/blob/238ca11c/docs/src/site/twiki/index.twiki
----------------------------------------------------------------------
diff --git a/docs/src/site/twiki/index.twiki b/docs/src/site/twiki/index.twiki
index c49752d..53b7552 100755
--- a/docs/src/site/twiki/index.twiki
+++ b/docs/src/site/twiki/index.twiki
@@ -41,7 +41,7 @@ allows integration with the whole enterprise data ecosystem.
    * [[TypeSystem][Type System]]
    * [[Repository][Metadata Repository]]
    * [[Search][Search]]
-   * [[security][security]]
+   * [[security][Security]]
    * [[Configuration][Configuration]]
    * Notification
       * [[Notification-Entity][Entity Notification]]

http://git-wip-us.apache.org/repos/asf/incubator-atlas/blob/238ca11c/docs/src/site/twiki/security.twiki
----------------------------------------------------------------------
diff --git a/docs/src/site/twiki/security.twiki b/docs/src/site/twiki/security.twiki
index d19beb4..84b19ad 100755
--- a/docs/src/site/twiki/security.twiki
+++ b/docs/src/site/twiki/security.twiki
@@ -42,6 +42,8 @@ The properties for configuring service authentication are:
    * <code>atlas.authentication.keytab</code> - the path to the keytab file.
    * <code>atlas.authentication.principal</code> - the principal to use for authenticating
to the KDC.  The principal is generally of the form "user/host@realm".  You may use the '_HOST'
token for the hostname and the local hostname will be substituted in by the runtime (e.g.
"Atlas/_HOST@EXAMPLE.COM").
 
+Note that when Atlas is configured with HBase as the storage backend in a secure cluster,
the graph db (titan) needs sufficient user permissions to be able to create and access an
HBase table.  To grant the appropriate permissions see [[Configuration][Graph persistence
engine - Hbase]].
+
 ---+++ SPNEGO-based HTTP Authentication
 
 HTTP access to the Atlas platform can be secured by enabling the platform's SPNEGO support.
 There are currently two supported authentication mechanisms:

http://git-wip-us.apache.org/repos/asf/incubator-atlas/blob/238ca11c/release-log.txt
----------------------------------------------------------------------
diff --git a/release-log.txt b/release-log.txt
index 24189fc..6413c21 100644
--- a/release-log.txt
+++ b/release-log.txt
@@ -9,6 +9,7 @@ ATLAS-54 Rename configs in hive hook (shwethags)
 ATLAS-3 Mixed Index creation fails with Date types (sumasai via shwethags)
 
 ALL CHANGES:
+ATLAS-344 Document HBase permissions for secure cluster (tbeerbower via shwethags)
 ATLAS-335 Kerberized cluster: Atlas fails to come up with hbase as backend (sumasai via shwethags)
 ATLAS-333 atlas_stop.py – script must delete “atlas.pid” file (ndjouhr via sumasai)
 ATLAS-220 Gets on Enum attribute should return EnumValue(yhemanth via sumasai)


Mime
View raw message