Authentication in Cloudera Surveyor for Apache Kafka

When Cloudera Surveyor is deployed with FIPS mode enabled (fipsMode: true), you must manually generate and configure an authentication key.

The authentication key is a random sequence of at least 32 bytes that is saved to a file. To generate it, use any tool or method that is available to you. Take note of the location and name of the file that you create. You will need to specify the file in a later step.

In non-FIPS deployments, you can skip this step. Cloudera Surveyor automatically generates a cryptographically secure random key if the key is not explicitly set.

keytool -import -trustcacerts -file [***LDAP ROOT CA***] \
  -keystore [***TRUSTSTORE NAME***] \
  -storepass [***TRUSTSTORE PASSWORD***] \
  -storetype PKCS12

kubectl create secret generic [***LDAP TRUSTSTORE SECRET***] \
  --namespace [***NAMESPACE***] \
  --from-file=[***TRUSTSTORE SECRET KEY***]=[***TRUSTSTORE NAME***] \
  --from-file=[***TRUSTSTORE PW SECRET KEY***]=[***PATH TO TRUSTSTORE PW FILE***]

kubectl create secret generic [***LDAP CREDENTIALS SECRET***] \
  --namespace [***NAMESPACE***] \
  --from-literal=principal="$(echo -n 'Enter principal: ' >&2; read -s principal; echo >&2; echo $principal)" --from-literal=password="$(echo -n 'Enter password: ' >&2; read -s password; echo >&2; echo $password)"

• Take note of [***LDAP CREDENTIALS SECRET***]. You will need to specify this name in a custom values file you create in a later step.

• Enter your principal and the password for the principal when prompted. Example principal:

  cn=admin,dc=openldap-chart,dc=ldap

The following configuration snippet is an example containing LDAP properties for a typical setup.

#...
surveyorConfig:
  surveyor:
    authentication:
      enabled: true
      userSessionTimeout: P1D
      inactivityTimeout: PT1H
      tokenRenewalInterval: PT10M
  quarkus:
    security:
      ldap:
        dir-context:
          url: ldaps://openldap-chart.ldap:1390
          principal: ${LDAP_PRINCIPAL}
          password: ${LDAP_PASSWORD}
        identity-mapping:
          rdn-identifier: uid
          search-base-dn: ou=users,dc=openldap-chart,dc=ldap
          attribute-mappings:
            "0": 
              from: uid
              filter: (uid={0})
              filter-base-dn: ou=users,dc=openldap-chart,dc=ldap
env:
  - name: LDAP_PRINCIPAL
    valueFrom:
      secretKeyRef:
        name: [***LDAP CREDENTIALS SECRET***]
        key: principal
  - name: LDAP_PASSWORD
    valueFrom:
      secretKeyRef:
        name: [***LDAP CREDENTIALS SECRET***]
        key: password
globalTruststore:
  secretRef:
    name: [***LDAP TRUSTSTORE SECRET***]
    key: [***TRUSTSTORE SECRET KEY***]
  type: PKCS12
  password:
    secretRef:
      name: [***LDAP TRUSTSTORE SECRET***]
      key: [***TRUSTSTORE PW SECRET KEY***]

• surveyorConfig.surveyor.authentication.enabled - Enables or disables authentication. Set to true by default. Included in the example as a reference, you do not need to set the property explicitly to enable authentication.

• surveyorConfig.surveyor.authentication.* - These properties control user session behavior and authentication token management. They define the session timeout, inactivity timeout, and the interval for renewing authentication tokens. All time intervals are specified in ISO 8601 format. For optimal security, Cloudera recommends that token renewal is shorter than or equal to half of the inactivity timeout.

• surveyorConfig.quarkus.security.ldap.dir-context.* - These properties configure the LDAP server that Cloudera Surveyor connects to. They specify the server URL, the distinguished name (DN) of the bind user, and the password of the bind user. These are required for establishing a secure connection with the LDAP directory.

  The bind user credentials ( principal and password) are referenced from the LDAP_PRINCIPAL and LDAP_PASSWORD environment variables. These environment variables are set using the env property. Their contents are referenced from a Secret that you created in a previous step.

• surveyorConfig.quarkus.security.ldap.identity-mapping.* - These properties configure how Cloudera Surveyor interacts with the LDAP directory to identify users and map their group memberships. They define the attributes and base DNs used to locate user entries and groups in the directory, as well as the filters applied to verify group membership.

  For more information regarding surveyorConfig.quarkus.* properties, see Using Security with an LDAP Realm in the Quarkus documentation.

• globalTruststore.secretRef.name - The name of the Kubernetes Secret containing the truststore of the LDAP server.

• globalTruststore.secretRef.key - The key in the Kubernetes Secret that contains the truststore.

• globalTruststore.password.name - The name of the Kubernetes Secret containing the truststore password.

• globalTruststore.password.key - The key in the Kubernetes Secret that contains the truststore password.

The helm upgrade command you run will differ depending on whether FIPS mode is enabled or not. If FIPS mode is enabled, you must include the authentication key file using the --set-file option. Otherwise, omit this option to use automatic key generation.

helm upgrade cloudera-surveyor [***CHART***] \
  --namespace [***NAMESPACE***] \
  --values [***VALUES.YML***]

helm upgrade cloudera-surveyor [***CHART***] \
  --namespace [***NAMESPACE***] \
  --values [***VALUES.YML***] \
  --set-file surveyorConfig.surveyor.authentication.keys.active=[***PATH TO AUTHENTICATION KEY FILE***]

Take note of the location and name of the file that you create. You will need to specify the file in a later step.

helm upgrade cloudera-surveyor [***CHART***] \
  --namespace [***NAMESPACE***]  
  --values [***VALUES.YAML***] \
  --set-file surveyorConfig.surveyor.authentication.keys.active=[***NEW KEY FILE***]

Notice that surveyorConfig.surveyor.authentication.keys.passive (the old key) is not provided. This removes and deactivates the old key.

kubectl rollout restart deployment/cloudera-surveyor \
  --namespace [***NAMESPACE***]

Monitor the restart with the kubectl rollout.

kubectl rollout status deployment/cloudera-surveyor \
  --namespace [***NAMESPACE***] \
  --watch

deployment "cloudera-surveyor" successfully rolled out