Security and governance
CDP implements security and governance using Kerberos for authentication, Apache Ranger
for policy enforcement and auditing, and Apache Atlas for metadata tagging and
lineage.
Authentication CDP Private Cloud Base clusters in a disaster recovery pair utilize Kerberos to mutually authenticate each other for data replication and service access purposes. The clusters must exist in a common Kerberos realm, or two realms with some form of trust. One-way or cross-realm Kerberos trusts are acceptable. Refer to your operating system manuals for details on implementing Kerberos trusts.Authorization CDP utilizes Apache Ranger to implement a common authorization policy framework across services and tracks user activity within those services. Services across a cluster interface with Ranger using a plugin framework. When a service uses Ranger policies, the service loads a plugin module that manages the authorization decisions, local service auditing, and syncing policy updates from the Ranger Admin interface.Auditing Ranger auditing is managed on a per-cluster basis. Ranger plugins log the audit details to both HDFS for long-term storage and to the infrastructure Solr instance for supporting audit search in the Ranger Admin UI. In the event that a Ranger plugin cannot write an audit log to either service, the plugin locally caches the audit event and attempts to replay it at a later time.