Configuring Kerberos

To enable Kerberos, you must provide an appropriate krb5.conf file. This file tells the DataFlow Function where the Key Distribution Center (KDC) is located and the Kerberos Realm to use.

To specify this, make the krb5.conf available to DataFlow Functions. You can do it by using the Lambda Layer or by placing the file in an S3 bucket. For more information, see S3 Bucket storage.

Additionally, you must tell DataFlow Function where it can find this krb5.conf file. To do this, add an environment variable to your Lambda function. The environment variable must have the name KRB5_FILE and the value must be the fully qualified filename of the krb5.conf file. For example, it might use /opt/krb5.conf.

In order to use Keytabs in your data flow, it is also important to provide the necessary keytab files to the DataFlow Function. You can accomplished it by using a Lambda Layer or an S3 bucket. While the krb5.conf file is a system configuration, the keytab is not. The keytab will be configured in the data flow on a per-component basis. For example, one processor may use keytab nifi-keytab-1 while some Controller Service makes use of keytab hive-keytab-4. The location of these files may change from deployment to deployment. For example, for an on-premises deployment, keytabs may be stored in /etc/security/keytabs while in DataFlow Function, they may be made available in /opt.

So it is better to use Parameter Contexts to parameterize the location of the keytab files. This is a good practice for any file-based resource that will need to be made available to a deployment. In this case, because there is a parameter referencing the location, you need to provide DataFlow Function with a value for that parameter. For more information, see Parameters.