Create JAAS configuration files

Create the following JAAS configuration files on the HBase Master, RegionServer, and HBase client host machines.

These files must be created under the $HBASE_CONF_DIR directory:

where $HBASE_CONF_DIR is the directory to store the HBase configuration files. For example, /etc/hbase/conf.

On each machine running an HBase server, create the hbase-server.jaas file under the /etc/hbase/conf directory and add the following content:
```
Client {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=true
storeKey=true
useTicketCache=false
keyTab="/etc/security/keytabs/hbase.service.keytab"
principal="hbase/$fully.qualified.domain.name";
};                         
```
On HBase client machines, create the hbase-client.jaas file under the /etc/hbase/conf directory. HBase servers include the HMaster and RegionServer. In this file, add the following content:
```
Client {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=false
useTicketCache=true;
};                   
```

Create the following JAAS configuration files on the ZooKeeper Server and client host machines.

These files must be created under the $ZOOKEEPER_CONF_DIR directory, where $ZOOKEEPER_CONF_DIR is the directory to store the HBase configuration files. For example, /etc/zookeeper/conf:

On ZooKeeper server host machines, create the zookeeper-server.jaas file under the /etc/zookeeper/conf directory and add the following content:

Server {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=true
storeKey=true
useTicketCache=false
keyTab="/etc/security/keytabs/zookeeper.service.keytab"
principal="zookeeper/$ZooKeeper.Server.hostname";
};

On ZooKeeper client host machines, create the zookeeper-client.jaas file under the /etc/zookeeper/conf directory and add the following content:
```
Client {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=false
useTicketCache=true;
};                 
```

Edit the hbase-env.sh file on your HBase server to add the following information:

export HBASE_OPTS ="-Djava.security.auth.login.config=
$HBASE_CONF_DIR/hbase-client.jaas"
export HBASE_MASTER_OPTS ="-Djava.security.auth.login.config=
$HBASE_CONF_DIR/hbase-server.jaas"
export HBASE_REGIONSERVER_OPTS="-Djava.security.auth.login.config=
$HBASE_CONF_DIR/hbase-server.jaas"

where HBASE_CONF_DIR is the HBase configuration directory. For example, /etc/hbase/conf.

Edit zoo.cfg file on your ZooKeeper server to add the following information:

authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider
jaasLoginRenew=3600000
kerberos.removeHostFromPrincipal=true
kerberos.removeRealmFromPrincipal=true

Edit zookeeper-env.sh file on your ZooKeeper server to add the following information:

export SERVER_JVMFLAGS ="-Djava.security.auth.login.config=$ZOOKEEPER_CONF_DIR/zookeeper-server.jaas"
export CLIENT_JVMFLAGS ="-Djava.security.auth.login.config=$ZOOKEEPER_CONF_DIR/zookeeper-client.jaas"

where $ZOOKEEPER_CONF_DIR is the ZooKeeper configuration directory. For example, /etc/zookeeper/conf.

​Create JAAS configuration files