Configuring custom Kerberos principals for Solr

In a Kerberos enabled cluster, the Solr service uses the solr principal by default. Changing the default principal and using custom principals is supported. Principals can be configured on a service-wide level in Cloudera Manager with the Kerberos Principal property.

Ensure that you have the following privileges:
- SSH access to the cluster where you want to enable the custom principal
- administrative privileges in Cloudera Manager
- HDFS super user access

If the SunJCE cryptographic provider is removed to run the zkcli.sh utility, you must set the JDK_JAVA_OPTIONS environment variable. For example,

export FIPS_JAVA_ARGS
=
"-Dcom.safelogic.cryptocomply.fips.approved_only=true  --add-modules=com.safelogic.cryptocomply.fips.core  --add-modules=bctls  --add-exports=java.base/sun.security.provider=com.safelogic.cryptocomply.fips.core  --add-exports=java.base/sun.security.provider=bctls  --module-path=/cdep/extra_jars  -Djdk.tls.trustNameService=true  -Dsun.security.krb5.disableReferrals=true  -Djdk.tls.ephemeralDHKeySize=2048  -Dcom.sun.management.jmxremote.ssl.enabled.protocols=TLSv1.2,TLSv1.3 --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.base/java.util.zip=ALL-UNNAMED --add-opens=java.base/java.io=ALL-UNNAMED --add-opens=java.base/java.lang.reflect=ALL-UNNAMED --add-opens=java.base/java.net=ALL-UNNAMED --add-exports=java.base/sun.net.www.protocol.jar=ALL-UNNAMED --add-opens=java.base/sun.net.www.protocol.jar=ALL-UNNAMED --add-opens=java.base/sun.net.www.protocol.file=ALL-UNNAMED --add-exports=java.base/sun.net.www=ALL-UNNAMED --add-opens=java.base/sun.net.www=ALL-UNNAMED"


export JDK_JAVA_OPTIONS
=
"${JDK_JAVA_OPTIONS} ${FIPS_JAVA_ARGS}"

Stop the Solr service.
Disable ZooKeeper ACL checking temporarily.
1. In Cloudera Manager, navigate to ZooKeeper > Configuration.
2. Find the Java Configuration Options for ZooKeeper Server property.
3. Add the following value:
```
-Dzookeeper.skipACL=yes
```
4. Click Save Changes.
5. Restart the ZooKeeper service.
In Cloudera Manager, navigate to Clusters > Solr service > Configuration and find the Kerberos Principal property.
Provide the custom Kerberos principal.
Click Save Changes.
If the Solr system user (service user) does not match the custom Kerberos principal, configure the solr.security.proxyuser properties for the system user:
1. In Cloudera Manager, navigate to Clusters > Solr service > Configuration and find the Solr Service Environment Advanced Configuration Snippet (Safety Valve) property.
2. Locate the SOLR_SECURITY_PROXY_JAVA_OPTS key and append its value with the following:
```
-Dsolr.security.proxyuser.[***SYSTEM_USER***].groups=* -Dsolr.security.proxyuser.[***SYSTEM_USER***].hosts=*
```
  Replace [***SYSTEM_USER***] with the service user name you want to associate with the custom Kerberos principal.
3. Click Save Changes.

Create a jaas.conf file containing the following:

Client {
           com.sun.security.auth.module.Krb5LoginModule required
           useKeyTab=false
           useTicketCache=true
           principal="[***CUSTOM_SOLR_KERBEROS_PRINCIPAL@KERBEROS_REALM_NAME***]";
           };

Replace [***CUSTOM_SOLR_KERBEROS_PRINCIPAL@KERBEROS_REALM_NAME***] with your Kerberos principal and realm name.

Set the LOG4J_PROPS environment variable to a log4j.properties file:
```
export LOG4J_PROPS=/etc/zookeeper/conf/log4j.properties
```

Set the ZKCLI_JVM_FLAGS environment variable:

export ZKCLI_JVM_FLAGS="-Djava.security.auth.login.config=/path/to/jaas.conf \ 
-DzkACLProvider=org.apache.solr.common.cloud.SaslZkACLProvider \ 
-Droot.logger=INFO,console \
-Dsolr.authorization.superuser=[***CUSTOM_SOLR_KERBEROS_PRINCIPAL***]"

Authenticate as the [***CUSTOM_SOLR_KERBEROS_PRINCIPAL***]:
```
kinit [***CUSTOM_SOLR_KERBEROS_PRINCIPAL@KERBEROS_REALM_NAME***]
```
Replace [***CUSTOM_SOLR_KERBEROS_PRINCIPAL@KERBEROS_REALM_NAME***] with your Kerberos principal and realm name.
Run the zkcli.sh script as follows:
```
/opt/cloudera/parcels/CDH/lib/solr/bin/zkcli.sh -zkhost [***ZOOKEEPER_SERVER_HOSTNAME***]:[***ZOOKEEPER_SERVER_PORT***] -cmd updateacls /solr
```
Replace [***ZOOKEEPER_SERVER_HOSTNAME***] and [***ZOOKEEPER_SERVER_PORT***] with the hostname and port of a ZooKeeper server.
note
If Solr ZooKeeper TLS is enabled, set ZKCLI_JVM_FLAGS as described in Using Search ZooKeeper CLI tools with TLS-enabled ZooKeeper before you run this command.
For example:
```
/opt/cloudera/parcels/CDH/lib/solr/bin/zkcli.sh -zkhost zk01.example.com:2181 -cmd updateacls /solr
```

Check ACLs in Zookeeper:

zookeeper-client -server ${HOSTNAME}:2181 getAcl /solr

Change ownership of Solr’s HDFS Data Directory. Check the value in Cloudera Manager under Solr > Configuration > HDFS Data Directory.

Execute the following command as the HDFS superuser:

hdfs dfs -chown -R [***CUSTOM_SOLR_KERBEROS_PRINCIPAL***] [***HDFS_DATA_DIRECTORY***]

Re-enable ZooKeeper ACL check.
1. In Cloudera Manager, navigate to ZooKeeper > Configuration.
2. Find the Java Configuration Options for ZooKeeper Server property.
3. Remove the following value:
```
-Dzookeeper.skipACL=yes
```
4. Click Save Changes.
5. Restart the ZooKeeper service.