Appendix: Configure Kerberos authentication
The data synchronization feature in DataWorks uses Kerberos authentication to ensure that only trusted applications and services can access your data resources. This topic describes the Kerberos authentication mechanism.
Background information
The Kerberos protocol is used for identity authentication in computer networks. It enables single sign-on (SSO). With SSO, a user authenticates once to obtain a Ticket-Granting Ticket (TGT). This TGT allows the user to access multiple services without re-entering credentials. The protocol establishes a shared key between each client and service for communication. This method prevents untrusted services or applications from accessing data resources and enhances security.
Limits
The Kerberos authentication feature is supported only for CDH 6.X clusters. Authentication may fail on other cluster versions or self-managed clusters because they have not been tested.
The Kerberos authentication feature supports only HBase, Hadoop Distributed File System (HDFS), and Hive data sources. Support for other data source types will be added in a future release.
The Kerberos authentication feature is supported only for exclusive resource groups for Data Integration.
Kerberos authentication process
Kerberos is a third-party authentication protocol that uses symmetric keys. Both clients and servers rely on the Key Distribution Center (KDC), a Kerberos server-side program, for identity authentication. For more information about Kerberos, see Overview.
The Kerberos authentication process in DataWorks consists of the following four stages:
Client requests a TGT: A client principal that wants to access a Kerberos-enabled data source first requests a TGT from the KDC. The TGT acts as a credential to verify the client's identity for subsequent service requests.
KDC issues a TGT: The KDC receives the request and authenticates the client. If the authentication is successful, the KDC issues an encrypted TGT with a limited lifetime to the client.
Client requests server access: After the client receives the TGT, it uses the service name to request access to a specific service resource.
Server authenticates the client: The server receives the request and authenticates the client. If the authentication is successful, the server grants the client access to the service resource.
The Kerberos authentication process requires a keytab authentication file and a krb5.conf configuration file. The krb5.conf file stores the configuration of the KDC server. The keytab file stores the authentication credentials of principals, which include the principals and their encrypted keys. Before you use Kerberos authentication, you must upload these two files to the authentication file management page. Then, on the data source configuration page, reference the authentication files and complete the configuration. For more information about how to upload authentication files and configure Kerberos for different data source types, see Third-party authentication file management and Data sources that support Kerberos authentication.
Data sources that support Kerberos authentication
The following table lists the data source types that support Kerberos and provides links to their configuration guides.
Data source type | Configuration guide |
HBase | |
HDFS | |
Hive |