Mailing-List: contact issues-help@drill.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@drill.apache.org
Date: Mon, 13 Feb 2017 21:23:42 +0000 (UTC)
From: "Sudheesh Katkam (JIRA)" <jira@apache.org>
To: issues@drill.apache.org
Message-ID: <JIRA.12850586.1438345912000.67552.1487021022190@Atlassian.JIRA>
In-Reply-To: <JIRA.12850586.1438345912000@Atlassian.JIRA>
References: <JIRA.12850586.1438345912000@Atlassian.JIRA> <JIRA.12850586.1438345912677@jira-lw-us.apache.org>
Subject: [jira] [Comment Edited] (DRILL-3584) Drill Kerberos HDFS Support /
 Documentation
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
archived-at: Mon, 13 Feb 2017 21:23:48 -0000


    [ https://issues.apache.org/jira/browse/DRILL-3584?page=3Dcom.atlassian=
.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=3D1586=
2111#comment-15862111 ]=20

Sudheesh Katkam edited comment on DRILL-3584 at 2/13/17 9:22 PM:
-----------------------------------------------------------------

I may be wrong, but AFAIK, following Nathan's blogpost is not sufficient fo=
r Drill to authenticate to a Kerberized HDFS (specially since ticket's expi=
re).

The following instructions SHOULD allow for end to end (user to HDFS) authe=
ntication, but I have not tested them since I do not have the infrastructur=
e to setup KDC or HDFS (and not possible to write a unit test for this, Min=
iDFS and Drill use the same auth library which has static variables that MU=
ST be different).

(1) Enable Drill login to KDC.

Once the changes in DRILL-4280 are merged (targeted for 1.10 release), the =
drillbit can be started with a Kerberos principal and keytab. Add appropria=
te config to drill-override.conf, something like:
{code}
drill.exec {
  security.auth.principal: =E2=80=9Cdrill/_host@REALM=E2=80=9D
  security.auth.keytab: =E2=80=9C/etc/drill/conf/drill.keytab=E2=80=9D
}
{code}
This assumes a service principal is created for Drill ([details here|http:/=
/www.microhowto.info/howto/create_a_service_principal_using_mit_kerberos.ht=
ml]). Ensure "drill" as a [user identity|http://hadoop.apache.org/docs/r1.2=
.1/hdfs_permissions_guide.html#User+Identity] exists in HDFS (Drill uses HD=
FS for [Dynamic UDFs|http://drill.apache.org/docs/dynamic-udfs/], etc.). At=
 startup, Drill will login to KDC, and when accessing HDFS, Drill uses the =
configured Kerberos credentials.

(2) Enable authentication from user to Drill.

This is strongly recommended, but optional.

(3) Enable Drill impersonation.

This is strongly recommended, but optional. Otherwise, access to HDFS happe=
n as "drill".

(4) Enable 'secure impersonation' in HDFS.

Setup "drill" as a proxy user for HDFS with the required privileges, [detai=
ls here|http://hadoop.apache.org/docs/r1.2.1/Secure_Impersonation.html]. Th=
is will allow Drill to act on behalf of the end user ("bob") when accessing=
 HDFS. For example, if "drill" is authorized to impersonate "bob", then whi=
le accessing the HDFS, access rights are checked for "bob" and authenticati=
on credentials of "drill" are verified.


was (Author: sudheeshkatkam):
I may be wrong, but AFAIK, following Nathan's blogpost is not sufficient fo=
r Drill to authenticate to a Kerberized HDFS (specially since ticket's expi=
re).

The following instructions SHOULD allow for end to end (user to HDFS) authe=
ntication, but I have not tested them since I do not have the infrastructur=
e to setup KDC or HDFS (and not possible to write a unit test for this, Min=
iDFS and Drill use the same auth library which has static variables that MU=
ST be different).

(1) Enable Drill login to KDC.

Once the changes in DRILL-4280 are merged (targeted for 1.10 release), the =
drillbit can be started with a Kerberos principal and keytab. Add appropria=
te config to drill-override.conf, something like:
{code}
drill.exec {
  security.auth.principal: =E2=80=9Cdrill/_host@REALM=E2=80=9D
  security.auth.keytab: =E2=80=9C/etc/drill/conf/drill.keytab=E2=80=9D
}
{code}
This assumes a service principal is created for Drill ([details here|http:/=
/www.microhowto.info/howto/create_a_service_principal_using_mit_kerberos.ht=
ml]). Ensure "drill" as a [user identity|http://hadoop.apache.org/docs/r1.2=
.1/hdfs_permissions_guide.html#User+Identity] exists in HDFS (Drill uses HD=
FS for [Dynamic UDFs|http://drill.apache.org/docs/dynamic-udfs/], etc.). At=
 startup, Drill will login to KDC, and when accessing HDFS, Drill uses the =
configured Kerberos credentials.

(2) Enable authentication from user to Drill.

This is strongly recommended, but optional.

(3) Enable Drill impersonation.

This is strongly recommended, but optional. Otherwise, access to HDFS happe=
n as "drill".

(4) Enable secure impersonation in HDFS.

Setup "drill" as a proxy user for HDFS with the required privileges, [detai=
ls here|http://hadoop.apache.org/docs/r1.2.1/Secure_Impersonation.html]. Th=
is will allow Drill to act on behalf of the end user ("bob") when accessing=
 HDFS. For example, if "drill" is authorized to impersonate "bob", then whi=
le accessing the HDFS, access rights are checked for "bob" and authenticati=
on credentials of "drill" are verified.

> Drill Kerberos HDFS Support / Documentation
> -------------------------------------------
>
>                 Key: DRILL-3584
>                 URL: https://issues.apache.org/jira/browse/DRILL-3584
>             Project: Apache Drill
>          Issue Type: New Feature
>    Affects Versions: 1.1.0
>            Reporter: Hari Sekhon
>            Priority: Critical
>              Labels: security
>
> I'm trying to find Drill docs for Kerberos support for secure HDFS cluste=
rs and it doesn't appear to be well tested / supported / documented yet.
> This product is Dead-on-Arrival if it doesn't integrate well with secure =
Hadoop clusters, specifically HDFS + Kerberos (plus obviously secure kerber=
ized Hive/HCatalog etc.)


--
This message was sent by Atlassian JIRA
(v6.3.15#6346)