Configuring Cloudera Data Explorer (Hue) to connect to TLS 1.2/TCPS-enabled databases

Learn how to configure an existing Data Explorer instance to connect to TLS-enabled MySQL, MariaDB, or PostgreSQL databases or TCPS-enabled Oracle database.

If TLS 1.2 is enabled on the database servers, and the databases are restricted or enforced to use TLS 1.2, then Data Explorer automatically uses the TLS1.2-compatible ciphers to communicate with the database securely. You do not have to configure any setting in Data Explorer's Advanced Configuration Snippet or any other configurations. This is applicable when using MySQL, MariaDB, or PostgreSQL databases as a backend database for Data Explorer.

To restrict the MySQL and MariaDB databases to use TLS 1.2, set the value of the require_secure_transport to true in the my.cnf file.

To manually enable TLS 1.2 on the Data Explorer instance, go to Cloudera Manager > Clusters > Hue service > Configurations and select the Enable TLS/SSL for Hue option.

The following section is specific for configuring Data Explorer to connect to a TCPS-enabled Oracle database.

You must have installed and configured Oracle as a backend database for Data Explorer as described in Using Oracle database with Hue.
You must have enabled TCPS on the Oracle database as described in Enabling TCPS for Oracle Database Server.
You must have created database users.

SSH in to the Data Explorer host as an administrator.
Copy the cwallet.sso file that is generated when you enabled SSL on the Oracle database to a desired location on the Data Explorer host and make sure its permissions are 644.

Change directory to the following:

cd [***ORACLE-INSTANT-CLIENT-HOME***]/network/admin

Create a file called sqlnet.ora and with the following content:

SSL_CLIENT_AUTHENTICATION = FALSE
WALLET_LOCATION =
            (SOURCE =
              (METHOD = FILE)
              (METHOD_DATA =
                (DIRECTORY = /[***PATH-TO-WALLET-FILE***])
              )
            )

Create a file called tnsnames.ora and with the following content:

ORCLPDB1_SSL =
        (DESCRIPTION =
          (ADDRESS = (PROTOCOL = TCPS)(HOST = [***HUE-DB-HOST***])(PORT = 
[***HUE-DB-PORT***]))
          (CONNECT_DATA =
            (SERVER = DEDICATED)
            (SERVICE_NAME = [***SERVICE-NAME***]))
          )
          (SECURITY =
            (MY_WALLET_DIRECTORY = /[***PATH-TO-WALLET-FILE***])
          )
        )

Log in to Cloudera Manager as an Administrator.
Go to Clusters > Hue service > Configuration and add the following connection string in the Hue Database Name field:
```
(DESCRIPTION=(LOAD_BALANCE=off)(FAILOVER=on)(CONNECT_TIMEOUT=5)(TRANSPORT_CONNECT_TIMEOUT=3)(RETRY_COUNT=3)(ADDRESS=(PROTOCOL=TCPS)(HOST=[***HUE-DB-HOST***])(PORT=[***HUE-DB-PORT***]))(CONNECT_DATA=(SERVICE_NAME=[***SERVICE-NAME***])(SECURITY =
 (MY_WALLET_DIRECTORY = /[***PATH-TO-WALLET-FILE***])))
```
Where,
[***HUE-DB-HOST***] is the FQDN of the database host
[***HUE-DB-PORT***] is the port for the Data Explorer database
[***SERVICE-NAME***] is the Oracle service name
[***PATH-TO-WALLET-FILE***] is the location at which you have copied the wallet file (cwallet.sso) on the Data Explorer host
Click Save Changes.
Restart the Data Explorer service.