Cloudera Docs

Knox topologies

Learn about the Knox topologies needed for proxying the authorization requests from external users for Cloudera Data Sharing.

Topology name: cdp-share-access.xml

<?xml version="1.0" encoding="UTF-8"?>
<topology>
   <uri>https://[***KNOX-HOST***]:8443/gateway/cdp-share-access</uri>
   <name>cdp-share-access</name>
   <timestamp>1714251374810</timestamp>
   <generated>false</generated>
   <redeployTime>0</redeployTime>
   <gateway>
      <provider>
         <role>federation</role>
         <name>JWTProvider</name>
         <enabled>true</enabled>
         <param>
            <name>knox.token.exp.server-managed</name>
            <value>true</value>
         </param>
      </provider>
      <provider>
         <role>identity-assertion</role>
         <name>Default</name>
         <enabled>true</enabled>
         <param>
            <name>group.mapping.$PRIMARY_GROUP</name>
            <value>(not (member username))</value>
         </param>
      </provider>
   </gateway>
   <service>
      <role>KNOXTOKEN</role>
      <param>
         <name>knox.token.ttl</name>
         <value>36000000</value>
      </param>
      <param>
           <name>knox.token.exp.server-managed</name>
           <value>true</value>
      </param>
      <param>
            <name>gateway.knox.token.limit.per.user</name>
            <value>-1</value>
      </param>


   </service>
   <service>
        <role>HMS-API</role>
      <url>http://[***HMS-HOST***]:8090</url>
    </service>

</topology>

Topology name: cdp-share-management.xml

<?xml version="1.0" encoding="UTF-8"?>
<topology>   <uri>http://[***KNOX-HOST***]:8443/gateway/cdp-share-management</uri>
   <name>cdp-share-management</name>
   <timestamp>1711399642000</timestamp>
   <generated>false</generated>
   <redeployTime>0</redeployTime>
   <gateway>
      <provider>
         <role>authentication</role>
         <name>ShiroProvider</name>
         <enabled>true</enabled>
         <param>
            <name>main.invalidRequest</name>
            <value>org.apache.shiro.web.filter.InvalidRequestFilter</value>
         </param>
         <param>
            <name>main.invalidRequest.blockBackslash</name>
            <value>false</value>
         </param>
         <param>
            <name>main.invalidRequest.blockNonAscii</name>
            <value>false</value>
         </param>
         <param>
            <name>main.invalidRequest.blockSemicolon</name>
            <value>false</value>
         </param>
         <param>
            <name>main.pamRealm</name>
            <value>org.apache.knox.gateway.shirorealm.KnoxPamRealm</value>
         </param>
         <param>
            <name>main.knoxAnonFilter</name>
            <value>org.apache.knox.gateway.filter.AnonymousAuthFilter</value>
         </param>
         <param>
            <name>urls./knoxtoken/api/v1/jwks.json</name>
            <value>knoxAnonFilter</value>
         </param>
         <param>
            <name>main.pamRealm.service</name>
            <value>login</value>
         </param>
         <param>
            <name>sessionTimeout</name>
            <value>30</value>
         </param>
         <param>
            <name>urls./**</name>
            <value>authcBasic</value>
         </param>
      </provider>
      <provider>
         <role>identity-assertion</role>
         <name>HadoopGroupProvider</name>
         <enabled>true</enabled>
         <param>
            <name>hadoop.proxyuser.impersonation.enabled</name>
            <value>true</value>
         </param>
         <param>
            <name>hadoop.proxyuser.{user-who-runs-the-script}.users</name>
            <value>*</value>
         </param>
         <param>
            <name>hadoop.proxyuser.{user-who-runs-the-script}.groups</name>
            <value>*</value>
         </param>
         <param>
            <name>hadoop.proxyuser.{user-who-runs-the-script}.hosts</name>
            <value>*</value>
         </param>
         <param>
            <name>CENTRAL_GROUP_CONFIG_PREFIX</name>
            <value>gateway.group.config.</value>
         </param>
      </provider>
      <provider>
         <role>authorization</role>
         <name>XASecurePDPKnox</name>
         <enabled>false</enabled>
      </provider>
      <provider>
         <role>ha</role>
         <name>HaProvider</name>
         <enabled>true</enabled>
         <param>
            <name>RANGER</name>
            <value>enableStickySession=false;noFallback=false;enableLoadBalancing=true</value>
         </param>
      </provider>
   </gateway>
   <service>
      <role>RANGER</role>
      <url>https://[***RANGER-HOST***]:6182</url>
   </service>
   <service>
      <role>KNOXTOKEN</role>
      <param>
         <name>knox.token.ttl</name>
         <value>-1</value>
      </param>
      <param>
         <name>knox.token.type</name>
         <value>JWT</value>
      </param>
      <param>
         <name>knox.token.target.url</name>
         <value>cdp-proxy-token</value>
      </param>
      <param>
         <name>knox.token.audiences</name>
         <value>cdp-proxy-token</value>
      </param>
      <param>
         <name>knox.token.client.data</name>
         <value>homepage_url=homepage/home?profile=token&amp;topologies=cdp-proxy-token</value>
      </param>
      <param>
         <name>knox.token.exp.tokengen.allowed.tss.backends</name>
         <value>JDBCTokenStateService,AliasBasedTokenStateService</value>
      </param>
      <param>
         <name>knox.token.lifespan.input.enabled</name>
         <value>true</value>
      </param>
      <param>
         <name>knox.token.user.limit.exceeded.action</name>
         <value>RETURN_ERROR</value>
      </param>
      <param>
         <name>knox.token.exp.server-managed</name>
         <value>true</value>
      </param>
   </service>
</topology>