Also available as:
loading table of contents...

Setting Up SPNEGO Authentication

SNPEGO/Kerberos authentication is configured by adding a "HadoopAuth" authentication provider to the cluster's topology file. When enabled, the Knox Gateway uses Kerberos/SPNEGO to authenticate users to Knox.

About This Task

The HadoopAuth authentication provider for Knox integrates the use of the Apache Hadoop module for SPNEGO and delegation token-based authentication. This introduces the same authentication pattern used across much of the Hadoop ecosystem to Apache Knox and allows clients to using the strong authentication and SSO capabilities of Kerberos.


To enable SNPEGO authentication:

  1. Open the cluster topology descriptor file, $cluster-name.xml, in a text editor.

  2. Add the HadoopAuth authentication provider to /topology/gateway as follows:


    Configuration parameter descrptions:

    config.prefixIf specified, all other configuration parameter names must start with the prefix.none
    signature.secretThis is the secret used to sign the delegation token in the hadoop.auth cookie. This same secret needs to be used across all instances of the Knox gateway in a given cluster. Otherwise, the delegation token will fail validation and authentication will be repeated each request.a simple random number
    typeThis parameter needs to be set to kerberos.none, would throw exception
    simple.anonymous.allowedThis should always be false for a secure deployment.true
    token.validityThe validity -in seconds- of the generated authentication token. This is also used for the rollover interval when signer.secret.provider is set to random or zookeeper.36000 seconds
    cookie.domaindomain to use for the HTTP cookie that stores the authentication tokennull
    cookie.pathpath to use for the HTTP cookie that stores the authentication tokennull
    kerberos.principalThe web-application Kerberos principal name. The Kerberos principal name must start with HTTP/…. For example: HTTP/localhost@LOCALHOSTnull
    kerberos.keytabThe path to the keytab file containing the credentials for the kerberos principal. For example: /Users/lmccay/lmccay.keytabnull name of the ruleset for extracting the username from the kerberos principal.DEFAULT
  3. Save the file.

    The gateway creates a new WAR file with modified timestamp in $gateway/data/deployments.

REST Invocation

Once a user logs in with kinit, their Kerberos session may be used across client requests with things such as curl. The following curl command can be used to request a directory listing from HDFS while authenticating with SPNEGO via the –negotiate flag:

curl -k -i --negotiate -u : https://localhost:8443/gateway/sandbox/webhdfs/v1/tmp?op=LISTSTATUS