Return-Path: X-Original-To: archive-asf-public-internal@cust-asf2.ponee.io Delivered-To: archive-asf-public-internal@cust-asf2.ponee.io Received: from cust-asf.ponee.io (cust-asf.ponee.io [163.172.22.183]) by cust-asf2.ponee.io (Postfix) with ESMTP id D6F59200C3A for ; Fri, 17 Mar 2017 06:39:46 +0100 (CET) Received: by cust-asf.ponee.io (Postfix) id D5775160B8E; Fri, 17 Mar 2017 05:39:46 +0000 (UTC) Delivered-To: archive-asf-public@cust-asf.ponee.io Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by cust-asf.ponee.io (Postfix) with SMTP id B81CA160B78 for ; Fri, 17 Mar 2017 06:39:44 +0100 (CET) Received: (qmail 87333 invoked by uid 500); 17 Mar 2017 05:39:43 -0000 Mailing-List: contact commits-help@atlas.incubator.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: dev@atlas.incubator.apache.org Delivered-To: mailing list commits@atlas.incubator.apache.org Received: (qmail 87324 invoked by uid 99); 17 Mar 2017 05:39:43 -0000 Received: from pnap-us-west-generic-nat.apache.org (HELO spamd2-us-west.apache.org) (209.188.14.142) by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 17 Mar 2017 05:39:43 +0000 Received: from localhost (localhost [127.0.0.1]) by spamd2-us-west.apache.org (ASF Mail Server at spamd2-us-west.apache.org) with ESMTP id 2247F1A0351 for ; Fri, 17 Mar 2017 05:39:43 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at spamd2-us-west.apache.org X-Spam-Flag: NO X-Spam-Score: -3.569 X-Spam-Level: X-Spam-Status: No, score=-3.569 tagged_above=-999 required=6.31 tests=[KAM_ASCII_DIVIDERS=0.8, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_NEUTRAL=0.652] autolearn=disabled Received: from mx1-lw-eu.apache.org ([10.40.0.8]) by localhost (spamd2-us-west.apache.org [10.40.0.9]) (amavisd-new, port 10024) with ESMTP id Aivjk6QestLw for ; Fri, 17 Mar 2017 05:39:31 +0000 (UTC) Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by mx1-lw-eu.apache.org (ASF Mail Server at mx1-lw-eu.apache.org) with SMTP id BE5DE5FC7B for ; Fri, 17 Mar 2017 05:39:28 +0000 (UTC) Received: (qmail 73309 invoked by uid 99); 17 Mar 2017 05:32:47 -0000 Received: from git1-us-west.apache.org (HELO git1-us-west.apache.org) (140.211.11.23) by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 17 Mar 2017 05:32:47 +0000 Received: by git1-us-west.apache.org (ASF Mail Server at git1-us-west.apache.org, from userid 33) id D943BDFF46; Fri, 17 Mar 2017 05:32:46 +0000 (UTC) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: madhan@apache.org To: commits@atlas.incubator.apache.org Date: Fri, 17 Mar 2017 05:32:48 -0000 Message-Id: In-Reply-To: <9c637ef9a9e44bd0a6ceefd30cde25ab@git.apache.org> References: <9c637ef9a9e44bd0a6ceefd30cde25ab@git.apache.org> X-Mailer: ASF-Git Admin Mailer Subject: [03/10] incubator-atlas-website git commit: updated site for 0.8 release archived-at: Fri, 17 Mar 2017 05:39:47 -0000 http://git-wip-us.apache.org/repos/asf/incubator-atlas-website/blob/ff453c82/0.8.0-incubating/license.html ---------------------------------------------------------------------- diff --git a/0.8.0-incubating/license.html b/0.8.0-incubating/license.html new file mode 100644 index 0000000..514f61a --- /dev/null +++ b/0.8.0-incubating/license.html @@ -0,0 +1,453 @@ + + + + + + + + + Apache Atlas – Project License + + + + + + + + + + + + + + + + + + +
+
+
+ + + + + + + + + + + + + + + +
  • + +
    + +
+ + +
+ +
+
+
+ +
+ + + + + + +
+
+

Overview

+

Typically the licenses listed for the project are that of the project itself, and not of dependencies.

+
+

Project License

+
+

The Apache Software License, Version 2.0

+
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+
+
+ +
+ + + + http://git-wip-us.apache.org/repos/asf/incubator-atlas-website/blob/ff453c82/0.8.0-incubating/mail-lists.html ---------------------------------------------------------------------- diff --git a/0.8.0-incubating/mail-lists.html b/0.8.0-incubating/mail-lists.html new file mode 100644 index 0000000..6f3a3fd --- /dev/null +++ b/0.8.0-incubating/mail-lists.html @@ -0,0 +1,265 @@ + + + + + + + + + Apache Atlas – Project Mailing Lists + + + + + + + + + + + + + + + + + + +
+
+
+ + + + + + + + + + + + + + + +
  • + +
    + +
+ + +
+ +
+
+
+ +
+ + + + + + +
+ +
+

Project Mailing Lists

+

These are the mailing lists that have been established for this project. For each list, there is a subscribe, unsubscribe, and an archive link.

+ + + + + + + + + + + + + + + + + + +
NameSubscribeUnsubscribePostArchive
atlas-devSubscribeUnsubscribePostmail-archives.apache.org
atlas-commitsSubscribeUnsubscribePostmail-archives.apache.org
+
+
+ +
+ + + + http://git-wip-us.apache.org/repos/asf/incubator-atlas-website/blob/ff453c82/0.8.0-incubating/project-info.html ---------------------------------------------------------------------- diff --git a/0.8.0-incubating/project-info.html b/0.8.0-incubating/project-info.html new file mode 100644 index 0000000..6fe4065 --- /dev/null +++ b/0.8.0-incubating/project-info.html @@ -0,0 +1,270 @@ + + + + + + + + + Apache Atlas – Project Information + + + + + + + + + + + + + + + + + + +
+
+
+ + + + + + + + + + + + + + + +
  • + +
    + +
+ + +
+ +
+
+
+ +
+ + + + + + +
+ +
+

Project Information

+

This document provides an overview of the various documents and links that are part of this project's general information. All of this content is automatically generated by Maven on behalf of the project.

+
+

Overview

+ + + + + + + + + + + + + + + + + + + + + +
DocumentDescription
AboutApache Atlas Documentation
Project TeamThis document provides information on the members of this project. These are the individuals who have contributed to the project in one form or another.
Mailing ListsThis document provides subscription and archive information for this project's mailing lists.
Issue TrackingThis is a link to the issue management system for this project. Issues (bugs, features, change requests) can be created and queried using this link.
Project LicenseThis is a link to the definitions of project licenses.
Source RepositoryThis is a link to the online source repository that can be viewed via a web browser.
+
+
+ +
+ + + + http://git-wip-us.apache.org/repos/asf/incubator-atlas-website/blob/ff453c82/0.8.0-incubating/security.html ---------------------------------------------------------------------- diff --git a/0.8.0-incubating/security.html b/0.8.0-incubating/security.html new file mode 100644 index 0000000..1e0df6f --- /dev/null +++ b/0.8.0-incubating/security.html @@ -0,0 +1,513 @@ + + + + + + + + + Apache Atlas – Security Features of Apache Atlas + + + + + + + + + + + + + + + + + + +
+
+
+ + + + + + + + + + + + + + + +
  • + +
    + +
+ + +
+ +
+
+
+ +
+ + + + + + +
+ +
+

Security Features of Apache Atlas

+
+

Overview

+

The following features are available for enhancing the security of the platform:

+
    +
  • SSL
    • +
  • Service Authentication
    • +
  • SPNEGO-based HTTP Authentication
+
+

SSL

+

Both SSL one-way (server authentication) and two-way (server and client authentication) are supported. The following application properties (properties configured in the atlas-application.properties file) are available for configuring SSL:

+

+
    +
  • atlas.enableTLS (false|true) [default: false] - enable/disable the SSL listener
    • +
  • keystore.file - the path to the keystore file leveraged by the server. This file contains the server certificate.
    • +
  • truststore.file - the path to the truststore file. This file contains the certificates of other trusted entities (e.g. the certificates for client processes if two-way SSL is enabled). In most instances this can be set to the same value as the keystore.file property (especially if one-way SSL is enabled).
    • +
  • client.auth.enabled (false|true) [default: false] - enable/disable client authentication. If enabled, the client will have to authenticate to the server during the transport session key creation process (i.e. two-way SSL is in effect).
    • +
  • cert.stores.credential.provider.path - the path to the Credential Provider store file. The passwords for the keystore, truststore, and server certificate are maintained in this secure file. Utilize the cputil script in the 'bin' directoy (see below) to populate this file with the passwords required.
    • +
  • atlas.ssl.exclude.cipher.suites - the excluded Cipher Suites list - NULL.,.*RC4.*,.*MD5.*,.*DES.*,.*DSS.* are weak and unsafe Cipher Suites that are excluded by default. If additional Ciphers need to be excluded, set this property with the default Cipher Suites such as atlas.ssl.exclude.cipher.suites=.*NULL.*, .*RC4.*, .*MD5.*, .*DES.*, .*DSS.*, and add the additional Ciper Suites to the list with a comma separator. They can be added with their full name or a regular expression. The Cipher Suites listed in the atlas.ssl.exclude.cipher.suites property will have precedence over the default Cipher Suites. One would keep the default Cipher Suites, and add additional ones to be safe.
+
+
Credential Provider Utility Script
+

In order to prevent the use of clear-text passwords, the Atlas platofrm makes use of the Credential Provider facility for secure password storage (see Hadoop Credential Command Reference for more information about this facility). The cputil script in the 'bin' directory can be leveraged to create the password store required.

+

To create the credential provdier for Atlas:

+

+ +

The credential provider will be generated and saved to the path provided.

+
+

Service Authentication

+

The Atlas platform, upon startup, is associated to an authenticated identity. By default, in an insecure environment, that identity is the same as the OS authenticated user launching the server. However, in a secure cluster leveraging kerberos, it is considered a best practice to configure a keytab and principal in order for the platform to authenticate to the KDC. This allows the service to subsequently interact with other secure cluster services (e.g. HDFS).

+

The properties for configuring service authentication are:

+

+
    +
  • atlas.authentication.method (simple|kerberos) [default: simple] - the authentication method to utilize. Simple will leverage the OS authenticated identity and is the default mechanism. 'kerberos' indicates that the service is required to authenticate to the KDC leveraging the configured keytab and principal.
    • +
  • atlas.authentication.keytab - the path to the keytab file.
    • +
  • atlas.authentication.principal - the principal to use for authenticating to the KDC. The principal is generally of the form "user/host@realm". You may use the '_HOST' token for the hostname and the local hostname will be substituted in by the runtime (e.g. "Atlas/_HOST@EXAMPLE.COM").
+

Note that when Atlas is configured with HBase as the storage backend in a secure cluster, the graph db (titan) needs sufficient user permissions to be able to create and access an HBase table. To grant the appropriate permissions see Graph persistence engine - Hbase.

+
+

JAAS configuration

+

In a secure cluster, some of the components (such as Kafka) that Atlas interacts with, require Atlas to authenticate itself to them using JAAS. The following properties are used to set up appropriate JAAS Configuration.

+

+
    +
  • <code>atlas.jaas.<code>client-id<code>.loginModuleName<code> - the authentication method used by the component (for example, com.sun.security.auth.module.Krb5LoginModule)
    • +
  • <code>atlas.jaas.<code>client-id<code>.loginModuleControlFlag<code> (required|requisite|sufficient|optional) [default: required]
    • +
  • <code>atlas.jaas.<code>client-id<code>.option.useKeyTab<code> (true|false)
    • +
  • <code>atlas.jaas.<code>client-id<code>.option.storeKey<code> (true | false)
    • +
  • <code>atlas.jaas.<code>client-id<code>.option.serviceName<code> - service name of server component
    • +
  • <code>atlas.jaas.<code>client-id<code>.option.keyTab<code> = <atlas keytab>
    • +
  • <code>atlas.jaas.<code>client-id<code>.option.principal<code> = <atlas principal>
+

For example, the following property settings in jaas-application.properties file

+
+
+
+atlas.jaas.KafkaClient.loginModuleName = com.sun.security.auth.module.Krb5LoginModule
+atlas.jaas.KafkaClient.loginModuleControlFlag = required
+atlas.jaas.KafkaClient.option.useKeyTab = true
+atlas.jaas.KafkaClient.option.storeKey = true
+atlas.jaas.KafkaClient.option.serviceName = kafka
+atlas.jaas.KafkaClient.option.keyTab = /etc/security/keytabs/kafka_client.keytab
+atlas.jaas.KafkaClient.option.principal = kafka-client-1@EXAMPLE.COM
+
+atlas.jaas.MyClient.0.loginModuleName = com.sun.security.auth.module.Krb5LoginModule
+atlas.jaas.MyClient.0.loginModuleControlFlag = required
+atlas.jaas.MyClient.0.option.useKeyTab = true
+atlas.jaas.MyClient.0.option.storeKey = true
+atlas.jaas.MyClient.0.option.serviceName = kafka
+atlas.jaas.MyClient.0.option.keyTab = /etc/security/keytabs/kafka_client.keytab
+atlas.jaas.MyClient.0.option.principal = kafka-client-1@EXAMPLE.COM
+
+atlas.jaas.MyClient.1.loginModuleName = com.sun.security.auth.module.Krb5LoginModule
+atlas.jaas.MyClient.1.loginModuleControlFlag = optional
+atlas.jaas.MyClient.1.option.useKeyTab = true
+atlas.jaas.MyClient.1.option.storeKey = true
+atlas.jaas.MyClient.1.option.serviceName = kafka
+atlas.jaas.MyClient.1.option.keyTab = /etc/security/keytabs/kafka_client.keytab
+atlas.jaas.MyClient.1.option.principal = kafka-client-1@EXAMPLE.COM
+
+
+
+

will set the JAAS configuration that is equivalent to the following jaas.conf file entries.

+
+
+
+KafkaClient {
+	com.sun.security.auth.module.Krb5LoginModule required
+	useKeyTab=true
+	storeKey=true
+	serviceName=kafka
+	keyTab="/etc/security/keytabs/kafka_client.keytab"
+	principal="kafka-client-1@EXAMPLE.COM";
+};
+MyClient {
+	com.sun.security.auth.module.Krb5LoginModule required
+	useKeyTab=true
+	storeKey=true
+	serviceName=kafka keyTab="/etc/security/keytabs/kafka_client.keytab"
+	principal="kafka-client-1@EXAMPLE.COM";
+};
+MyClient {
+	com.sun.security.auth.module.Krb5LoginModule optional
+	useKeyTab=true
+	storeKey=true
+	serviceName=kafka
+	keyTab="/etc/security/keytabs/kafka_client.keytab"
+	principal="kafka-client-1@EXAMPLE.COM";
+};
+
+
+
+
+

SPNEGO-based HTTP Authentication

+

HTTP access to the Atlas platform can be secured by enabling the platform's SPNEGO support. There are currently two supported authentication mechanisms:

+

+
    +
  • simple - authentication is performed via a provided user name
    • +
  • kerberos - the KDC authenticated identity of the client is leveraged to authenticate to the server
+

The kerberos support requires the client accessing the server to first authenticate to the KDC (usually this is done via the 'kinit' command). Once authenticated, the user may access the server (the authenticated identity will be related to the server via the SPNEGO negotiation mechanism).

+

The properties for configuring the SPNEGO support are:

+

+
    +
  • atlas.http.authentication.enabled (true|false) [default: false] - a property indicating whether to enable HTTP authentication
    • +
  • atlas.http.authentication.type (simple|kerberos) [default: simple] - the authentication type
    • +
  • atlas.http.authentication.kerberos.principal - the web-application Kerberos principal name. The Kerberos principal name must start with "HTTP/...". For example: "HTTP/localhost@LOCALHOST". There is no default value.
    • +
  • atlas.http.authentication.kerberos.keytab - the path to the keytab file containing the credentials for the kerberos principal.
    • +
  • atlas.rest.address - <http/https>://<atlas-fqdn>:<atlas port>
+

For a more detailed discussion of the HTTP authentication mechanism refer to Hadoop Auth, Java HTTP SPNEGO 2.6.0 - Server Side Configuration. The prefix that document references is "atlas.http.authentication" in the case of the Atlas authentication implementation.

+
+

Client security configuration

+

When leveraging Atlas client code to communicate with an Atlas server configured for SSL transport and/or Kerberos authentication, there is a requirement to provide the Atlas client configuration file that provides the security properties that allow for communication with, or authenticating to, the server. Update the atlas-application.properties file with the appropriate settings (see below) and copy it to the client's classpath or to the directory specified by the "atlas.conf" system property.

+

The client properties for SSL communication are:

+

+
    +
  • atlas.enableTLS (false|true) [default: false] - enable/disable the SSL client communication infrastructure.
    • +
  • keystore.file - the path to the keystore file leveraged by the client. This file is only required if 2-Way SSL is enabled at the server and contains the client certificate.
    • +
  • truststore.file - the path to the truststore file. This file contains the certificates of trusted entities (e.g. the certificates for the server or a shared certification authority). This file is required for both one-way or two-way SSL.
    • +
  • cert.stores.credential.provider.path - the path to the Credential Provider store file. The passwords for the keystore, truststore, and client certificate are maintained in this secure file.
+

The property required for authenticating to the server (if authentication is enabled):

+

+
    +
  • atlas.http.authentication.type (simple|kerberos) [default: simple] - the authentication type
+
+

SOLR Kerberos configuration

+

If the authentication type specified is 'kerberos', then the kerberos ticket cache will be accessed for authenticating to the server (Therefore the client is required to authenticate to the KDC prior to communication with the server using 'kinit' or a similar mechanism).

+

See the Apache SOLR Kerberos configuration.

+

+
    +
  • Add principal and generate the keytab file for solr. Create a keytab per host for each host where Solr is going to run and use the principal name with the host (e.g. addprinc -randkey solr/${HOST1}@EXAMPLE.COM. Replace ${HOST1} with the actual host names).
+
+
+   kadmin.local
+   kadmin.local:  addprinc -randkey solr/<hostname>@EXAMPLE.COM
+   kadmin.local:  xst -k solr.keytab solr/<hostname>@EXAMPLE.COM
+   kadmin.local:  quit
+
+
+

+
    +
  • Add principal and generate the keytab file for authenticating HTTP request. (Note that if Ambari is used to Kerberize the cluster, the keytab /etc/security/keytabs/spnego.service.keytab can be used)
+
+
+   kadmin.local
+   kadmin.local:  addprinc -randkey HTTP/<hostname>@EXAMPLE.COM
+   kadmin.local:  xst -k HTTP.keytab HTTP/<hostname>@EXAMPLE.COM
+   kadmin.local:  quit
+
+
+

+
    +
  • Copy the keytab file to all the hosts running Solr.
+
+
+   cp solr.keytab /etc/security/keytabs/
+   chmod 400 /etc/security/keytabs/solr.keytab
+
+   cp HTTP.keytab /etc/security/keytabs/
+   chmod 400 /etc/security/keytabs/HTTP.keytab
+
+
+

+
    +
  • Create path in Zookeeper for storing the Solr configs and other parameters.
+
+
+   $SOLR_INSTALL_HOME/server/scripts/cloud-scripts/zkcli.sh -zkhost $ZK_HOST:2181 -cmd makepath solr
+
+
+

+
    +
  • Upload the configuration to Zookeeper.
+
+
+   $SOLR_INSTALL_HOME/server/scripts/cloud-scripts/zkcli.sh -cmd upconfig  -zkhost $ZK_HOST:2181/solr -confname basic_configs -confdir $SOLR_INSTALL_HOME/server/solr/configsets/basic_configs/conf
+
+
+

+
    +
  • Create the JAAS configuration.
+
+
+   vi /etc/solr/conf/solr_jaas.conf
+
+   Client {
+     com.sun.security.auth.module.Krb5LoginModule required
+     useKeyTab=true
+     keyTab="/etc/security/keytabs/solr.keytab"
+     storeKey=true
+     useTicketCache=true
+     debug=true
+     principal="solr/<hostname>@EXAMPLE.COM";
+   };
+
+
+

+
    +
  • Copy /etc/solr/conf/solr_jaas.conf to all hosts running Solr.
+

+
    +
  • Edit solr.in.sh in $SOLR_INSTALL_HOME/bin/
+
+
+   vi $SOLR_INSTALL_HOME/bin/solr.in.sh
+
+   SOLR_JAAS_FILE=/etc/solr/conf/solr_jaas.conf
+   SOLR_HOST=`hostname -f`
+   ZK_HOST="$ZK_HOST1:2181,$ZK_HOST2:2181,$ZK_HOST3:2181/solr"
+   KERBEROS_REALM="EXAMPLE.COM"
+   SOLR_KEYTAB=/etc/solr/conf/solr.keytab
+   SOLR_KERB_PRINCIPAL=HTTP@${KERBEROS_REALM}
+   SOLR_KERB_KEYTAB=/etc/solr/conf/HTTP.keytab
+   SOLR_AUTHENTICATION_CLIENT_CONFIGURER="org.apache.solr.client.solrj.impl.Krb5HttpClientConfigurer"
+   SOLR_AUTHENTICATION_OPTS=" -DauthenticationPlugin=org.apache.solr.security.KerberosPlugin -Djava.security.auth.login.config=${SOLR_JAAS_FILE} -Dsolr.kerberos.principal=${SOLR_KERB_PRINCIPAL} -Dsolr.kerberos.keytab=${SOLR_KERB_KEYTAB} -Dsolr.kerberos.cookie.domain=${SOLR_HOST} -Dhost=${SOLR_HOST} -Dsolr.kerberos.name.rules=DEFAULT"
+
+
+

+
    +
  • Copy solr.in.sh to all hosts running Solr.
+

+
    +
  • Set up Solr to use the Kerberos plugin by uploading the security.json.
+
+
+   $SOLR_INSTALL_HOME/server/scripts/cloud-scripts/zkcli.sh -zkhost <zk host>:2181 -cmd put /security.json '{"authentication":{"class": "org.apache.solr.security.KerberosPlugin"}}'
+
+
+

+
    +
  • Start Solr.
+
+
+   $SOLR_INSTALL_HOME/bin/solr start -cloud -z $ZK_HOST1:2181,$ZK_HOST2:2181,$ZK_HOST3:2181 -noprompt
+
+
+

+
    +
  • Test Solr
+
+
+   kinit -k -t /etc/security/keytabs/HTTP.keytab HTTP/<host>@EXAMPLE.COM
+   curl --negotiate -u : "http://<host>:8983/solr/"
+
+
+

+
    +
  • Create collections in Solr corresponding to the indexes that Atlas uses and change the Atlas configuration to point to the Solr instance setup as described in the Install Steps.
+
+
+ +
+ + + + http://git-wip-us.apache.org/repos/asf/incubator-atlas-website/blob/ff453c82/0.8.0-incubating/source-repository.html ---------------------------------------------------------------------- diff --git a/0.8.0-incubating/source-repository.html b/0.8.0-incubating/source-repository.html new file mode 100644 index 0000000..1e3192a --- /dev/null +++ b/0.8.0-incubating/source-repository.html @@ -0,0 +1,264 @@ + + + + + + + + + Apache Atlas – Source Repository + + + + + + + + + + + + + + + + + + +
+
+
+ + + + + + + + + + + + + + + +
  • + +
    + +
+ + +
+ +
+
+
+ +
+ + + + + + +
+ +
+

Overview

+

This project uses a Source Content Management System to manage its source code.

+
+

Web Access

+

The following is a link to the online source repository.

+
+
https://github.com/apache/incubator-atlas.git
+
+

Anonymous access

+

Refer to the documentation of the SCM used for more information about anonymously check out. The connection url is:

+
+
git://git.apache.org/incubator-atlas.git
+
+

Developer access

+

Refer to the documentation of the SCM used for more information about developer check out. The connection url is:

+
+
https://git-wip-us.apache.org/repos/asf/incubator-atlas.git
+
+

Access from behind a firewall

+

Refer to the documentation of the SCM used for more information about access behind a firewall.

+
+
+ +
+ + + +