For HBase to run on a secured cluster, HBase must be able to authenticate itself to HDFS. Add the following information to the hbase-site.xml file on your HBase server. There are no default values; the following are only examples:

Following is the XML for these entries:

<property> 
     <name>hbase.master.keytab.file</name> 
     <value>/etc/security/keytabs/hbase.service.keytab</value> 
     <description>Full path to the kerberos keytab file to use for logging
     in the configured HMaster server principal. 
     </description> 
</property> 
 
<property> 
     <name>hbase.master.kerberos.principal</name> 
     <value>hm/_HOST@EXAMPLE.COM</value> 
      <description>Ex. "hbase/_HOST@EXAMPLE.COM". 
     The Kerberos principal name that should be used to run the HMaster 
     process. The principal name should be in the form: user/hostname@DOMAIN. 
     If "_HOST" is used as the hostname portion, it will be replaced with
     the actual hostname of the running instance.
     </description> 
</property> 
 
<property> 
     <name>hbase.regionserver.keytab.file</name> 
     <value>/etc/security/keytabs/hbase.service.keytab</value> 
     <description>Full path to the kerberos keytab file to use for logging
     in the configured HRegionServer server principal. 
     </description> 
</property> 
 
<property> 
     <name>hbase.regionserver.kerberos.principal</name> 
     <value>hbase/_HOST@EXAMPLE.COM</value> 
     <description>Ex. "hbase/_HOST@EXAMPLE.COM". 
     The kerberos principal name that
     should be used to run the HRegionServer process. The
     principal name should be in the form: 
     user/hostname@DOMAIN. If _HOST
     is used as the hostname portion, it will be replaced 
     with the actual hostname of the running
     instance. An entry for this principal must exist
     in the file specified in hbase.regionserver.keytab.file 
     </description> 
</property> 
 
<!--Additional configuration specific to HBase security -->
 
<property> 
     <name>hbase.superuser</name> 
     <value>hbase</value> 
     <description>List of users or groups (comma-separated), who are
     allowed full privileges, regardless of stored ACLs, across the cluster.
     Only used when HBase security is enabled. 
     </description> 
</property> 
 
<property> 
     <name>hbase.coprocessor.region.classes</name> 
     <value>org.apache.hadoop.hbase.security.token.TokenProvider,
     org.apache.hadoop.hbase.security.access.SecureBulkLoadEndpoint,
     org.apache.hadoop.hbase.security.access.AccessController</value> 
     <description>A comma-separated list of coprocessors that are loaded
     by default on all tables. For any override coprocessor method, 
     these classes will be called in order. After implementing your 
     own coprocessor, just put it in HBase's classpath and add the 
     fully qualified class name here. A coprocessor can also be loaded on 
     demand by setting HTableDescriptor. 
     </description> 
</property> 
 
<property> 
     <name>hbase.coprocessor.master.classes</name> 
     <value>org.apache.hadoop.hbase.security.access.AccessController</value> 
     <description>A comma-separated list of MasterObserver coprocessors that
     are loaded by by the active HMaster process. For any implemented coprocessor
     methods, the listed classes will be called in order. After implementing your
     own MasterObserver, add the class to HBase's classpath and add the fully
     qualified class name here.  
     </description> 
</property>

<property>
    <name>hbase.coprocessor.regionserver.classes</name>
    <value>org.apache.hadoop.hbase.security.access.AccessController</value>
    <description>A comma-separated list of RegionServerObserver coprocessors
    that are loaded by the HRegionServer processes. For any implemented 
    coprocessor methods, the listed classes will be called in order. After 
    implementing your own RegionServerObserver, add the class to the HBase 
    classpath and fully qualified class name here.
    </description>
</property>