Hortonworks Data Platform

Knox Gateway Administration Guide

Except where otherwise noted, this document is licensed under Creative Commons Attribution ShareAlike 3.0 License

http://creativecommons.org/licenses/by-sa/3.0/legalcode

Hortonworks Data Platform (HDP) and any of its components are not anticipated to be combined with any hardware, software or data, except as expressly recommended in this documentation.

2014-12-02

Abstract

The Hortonworks Data Platform, powered by Apache Hadoop, is a massively scalable and 100% open source platform for storing, processing and analyzing large volumes of data. It is designed to deal with data from many sources and formats in a very quick, easy and cost-effective manner. The Hortonworks Data Platform consists of the essential set of Apache Hadoop projects including MapReduce, Hadoop Distributed File System (HDFS), HCatalog, Pig, Hive, HBase, Zookeeper and Ambari. Hortonworks is the major contributor of code and patches to many of these projects. These projects have been integrated and tested as part of the Hortonworks Data Platform release process and installation and configuration tools have also been included.

Unlike other providers of platforms built using Apache Hadoop, Hortonworks contributes 100% of our code back to the Apache Software Foundation. The Hortonworks Data Platform is Apache-licensed and completely open source. We sell only expert technical support, training and partner-enablement services. All of our technology is, and will remain free and open source.

Please visit the Hortonworks Data Platform page for more information on Hortonworks technology. For more information on Hortonworks services, please visit either the Support or Training page. Feel free to Contact Us directly to discuss your specific needs.

Contents

1. Apache Knox Gateway Overview

1. Knox Gateway Deployment Architecture
2. Supported Hadoop Services

2. Configuring the Knox Gateway

1. Create and Secure the Gateway Directories
2. Customize the Gateway Port and Path
3. Manage the Master Secret
4. Manually Redeploy Cluster Topologies
5. Manually Start and Stop Apache Knox

3. Defining Cluster Topologies

4. Configuring the Knox Topology to Connect to Hadoop Cluster Services

1. Setting up Hadoop Service URLs
2. Example Service Definitions
3. Validating Service Connectivity

5. Mapping the Internal Nodes to External URLs

1. Setting Up a Hostmap Provider
2. Example of an EC2 Hostmap Provider
3. Example of Sandbox Hostmap Provider
4. Enabling Hostmap Debugging

6. Configuring Authentication

1. Setting Up LDAP Authentication
2. Example of an Active Directory Configuration
3. Example of an OpenLDAP Configuration
4. Testing an LDAP Provider
5. Setting Up HTTP Header Authentication for Federation_SSO
6. Example of SiteMinder Configuration
7. Testing HTTP Header Tokens

7. Configuring Identity Assertion

1. Structure of the Identity-Assertion Provider
2. Define Pseudo Identity Assertion
3. Mapping Authenticated User to Cluster
4. Example User Mapping
5. Mapping Authenticated Users to Groups
6. Configuring Group Mapping
7. Examples of Group Mapping

8. Configuring Service Level Authorization

1. Setting Up an Authorization Provider
2. Examples of Authorization

9. Audit Gateway Activity

1. Audit Log Fields
2. Change Roll Frequency of the Audit Log

10. Gateway Security

1. Implementing Web Application Security
2. Configuring Protection Filter Against Cross Site Request Forgery Attacks
3. Validate CSRF Filtering
4. Configuring Knox With a Secured Hadoop Cluster
5. Configure Wire Encryption
6. Self-Signed Certificate with Specific Hostname for Evaluations
7. CA-Signed Certificates for Production
8. Setting Up Trust for the Knox Gateway Clients

11. Setting Up Knox for WebHDFS HA

1. Configure WebHDFS for Knox
2. Configure Knox for WebHDFS HA

List of Tables

1.1. Supported Hadoop Services
2.1. Apache Service Gateway Directores
3.1. Cluster Topology Provider and Service Roles

Legal notices