This is the documentation for CDH 5.0.x. Documentation for other versions is available at Cloudera Documentation.

Integrating Hadoop Security with Alternate Authentication

One of the ramifications of enabling security on a Hadoop cluster is that every user who interacts with the cluster must have a Kerberos principal configured. For some of the services, specifically Oozie and Hadoop (for example, JobTracker and TaskTracker), it can be convenient to run a mixed form of authentication where Kerberos authentication is used for API or command line access while some other form of authentication (for example, SSO and LDAP) is used for accessing Web UIs. Using an alternate authentication deployment is considered an advanced topic because only a partial implementation is provided in this release: you will have to implement some of the code yourself.

Note:

The following instructions assume you have already performed the installation and configuration steps in Configuring Hadoop Security in CDH 5.

Proceed as follows:

See also the Example Implementation for Oozie.

Step 1: Configure the AuthenticationFilter to use Kerberos

First, you must do all of the steps in the Server Side Configuration section of the Hadoop Auth, Java HTTP SPNEGO Documentation to configure AuthenticationFilter to use Kerberos. You must configure AuthenticationFilter to use Kerberos before doing the steps below.

Step 2: Creating an AltKerberosAuthenticationHandler Subclass

An AuthenticationHandler is installed on the server-side to handle authenticating clients and creating an AuthenticationToken.

Subclass the org.apache.hadoop.security.authentication.server.AltKerberosAuthenticationHandler class (in the hadoop-auth package).
When a client sends a request, the authenticate method will be called. For browsers, AltKerberosAuthenticationHandler will call the alternateAuthenticate method, which is what you need to implement to interact with the desired authentication mechanism. For non-browsers, AltKerberosAuthenticationHandler will follow the Kerberos SPNEGO sequence (this is provided for you).
The alternateAuthenticate(HttpServletRequest request, HttpServletResponse response) method in your subclass should following these rules:
Return null if the authentication is still in progress; the response object can be used to interact with the client.
Throw an AuthenticationException if the authentication failed.
Return an AuthenticationToken if the authentication completed successfully.

Step 3: Enabling Your AltKerberosAuthenticationHandler Subclass

You can enable the alternate authentication on Hadoop Web UIs, Oozie Web UIs, or both. You will need to include a JAR containing your subclass on the classpath of Hadoop and/or Oozie. All Kerberos-related configuration properties will still apply.

Step 3a: Enabling Your AltKerberosAuthenticationHandler Subclass on Hadoop Web UIs

Stop Hadoop by running the following command on every node in your cluster (as root):
```
$ for x in `cd /etc/init.d ; ls hadoop-*` ; do sudo service $x stop ; done
```
Set the following property in core-site.xml, where org.my.subclass.of.AltKerberosAuthenticationHandler is the classname of your subclass:
```
<property>
  <name>hadoop.http.authentication.type</name>
  <value>org.my.subclass.of.AltKerberosAuthenticationHandler</value>
</property>
```
(Optional) You can also specify which user-agents you do not want to be considered as browsers by setting the following property as required (default value is shown). Note that all Java-based programs (such as Hadoop client) will use java as their user-agent.
```
<property>
  <name>hadoop.http.authentication.alt-kerberos.non-browser.user-agents</name>
  <value>java,curl,wget,perl</value>
</property>
```
Copy the JAR containing your subclass into /usr/lib/hadoop/lib/.

Start Hadoop by running the following command:

$ for x in `cd /etc/init.d ; ls hadoop-*` ; do sudo service $x start ; done

Step 3b: Enabling Your AltKerberosAuthenticationHandler Subclass on Oozie Web UI

Note:

These instructions assume you have already performed the installation and configuration steps in Oozie Security Configuration.

Stop the Oozie Server:
```
sudo /sbin/service oozie stop
```
Set the following property in oozie-site.xml, where org.my.subclass.of.AltKerberosAuthenticationHandler is the classname of your subclass:
```
<property>
  <name>oozie.authentication.type</name>
  <value>org.my.subclass.of.AltKerberosAuthenticationHandler</value>
</property>
```
(Optional) You can also specify which user-agents you do not want to be considered as browsers by setting the following property as required (default value is shown). Note that all Java-based programs (such as Hadoop client) will use java as their user-agent.
```
<property>
  <name>oozie.authentication.alt-kerberos.non-browser.user-agents</name>
  <value>java,curl,wget,perl</value>
</property>
```
Copy the JAR containing your subclass into /var/lib/oozie.
Start the Oozie Server:
```
sudo /sbin/service oozie start
```

Example Implementation for Oozie

Warning:

The example implementation is NOT SECURE. Its purpose is to be as simple as possible, as an example of how to write your own AltKerberosAuthenticationHandler subclass.

It should NOT be used in a production environment

An example implementation of AltKerberosAuthenticationHandler is included (though not built by default) with Oozie. Also included is a simple Login Server with two implementations. The first one will authenticate any user who is using a username and password that are identical, such as foo:foo. The second one can be configured against an LDAP server to use LDAP for authentication.

You can read comprehensive documentation on the example at Creating Custom Authentication.

Important:

If you installed Oozie from the CDH packages and are deploying oozie-login.war alongside oozie.war, you will also need to run the following commands after you copy the oozie-login.war file to /usr/lib/oozie/oozie-server (if using YARN or /usr/lib/oozie/oozie-server-0.20 if using MRv1) because it won't automatically be expanded:

jar xvf oozie-login.war
mkdir oozie-login
mv META-INF oozie-login/
mv WEB-INF oozie-login/

Page generated September 3, 2015.