Set up cluster identity mapping

Mapping types

When you register a CDH cluster in DataWorks, you can use the Default Access Identity parameter to specify the account used to run task code in the CDH cluster. For more information, see Configure the default access identity for a cluster. The following table describes the account types and mapping types that you can configure for the Default Access Identity parameter.

Prerequisites

• You have created the required CDH cluster accounts.

• Before you use Kerberos account mapping, make sure that the Kerberos service is enabled on the cluster.

• Before you use OPEN LDAP account mapping, make sure that the OPEN LDAP service is enabled on the cluster.

• A CDH computing resource is bound to the DataWorks workspace.

Step 1: Go to the account mapping page

1. Log on to the DataWorks console. After switching to the destination region, click More > Management Center in the left-side navigation pane. From the drop-down list, select the target workspace and click Go to Management Center.

2. In the left-side navigation pane, click Computing Resources to go to the computing resources page.

3. On the computing resources page, find the target CDH cluster and click Account Mappings > Edit Account Mapping below the cluster name.

   On this page, you can configure mappings between Alibaba Cloud accounts in DataWorks and CDH cluster accounts. This determines which cluster account runs CDH tasks submitted by an Alibaba Cloud account.

Step 2: Set up cluster account mapping

This configuration determines which cluster account runs task code for CDH tasks in DataWorks. Follow these steps:

1. Select a mapping type.

   You can select No Authentication, Mapping to System Account, Mapping to OpenLDAP Account, or Mapping to Kerberos Account. For more information, see Mapping types.

2. Configure the cluster account mapping.

   Note

   If you select No Authentication, you do not need to configure mappings. The platform runs tasks using the cluster account specified in the basic information during cluster registration. For more information, see Bind a CDH computing resource.

   System account mapping

   To map an Alibaba Cloud account (Alibaba Cloud account or RAM user) to a CDH cluster system account, add the required account information.

   • Run tasks using an Alibaba Cloud account: Select an Alibaba Cloud account and configure the mapped cluster system account.

   • Run tasks using a RAM user: Select a RAM user and configure the mapped cluster system account. Two mapping relationships are supported:

     • Same-name mapping (default): Runs CDH tasks using a cluster system account with the same name as the RAM user. For example:

       • Alibaba Cloud RAM user: ram_user_1@xxx.onaliyun.com

       • Same-name cluster account: ram_user_1

       After this mapping is configured, CDH tasks submitted by ram_user_1@xxx.onaliyun.com run as ram_user_1.

       Note

       • By default, when you run CDH tasks in DataWorks as a RAM user, DataWorks runs the tasks using the cluster system account that has the same name. You can also map the RAM user to a cluster account with a different name.

       • To prevent task failures, make sure that an account with the same name exists in the CDH cluster. You can go to the CDH Cluster Management > User Management page to configure the account.

     • Different-name mapping: Runs CDH tasks using a cluster system account that has a different name from the mapped RAM user. Follow the on-screen instructions to configure the mapping.

   Kerberos account mapping

   Configure mappings between Alibaba Cloud accounts (Alibaba Cloud accounts or RAM users) and CDH Kerberos accounts. A Kerberos account uses the instance_name@REALM_NAME format, for example, cdn_test@HADOOP.COM.

   Kerberos authentication requires a keytab file and a krb5.conf file:

   • The krb5.conf file stores the Key Distribution Center (KDC) server configurations.

   • The keytab file stores the authentication credentials of a resource principal. The filename must follow the Kerberos account.keytab format.

   Add the required account information and upload the required files as prompted on the page.

   Note

   • You must use this mapping type when Kerberos authentication is enabled for Hive Metastore in the CDH cluster. Otherwise, metadata retrieval will be affected.

   • If you use the Presto component and select this mapping type, you must configure the Config.Properties and Presto.Jks files in the cluster's basic information.

   • Make sure that the Kerberos service is enabled on the cluster.

   OPEN LDAP account mapping

   Configure mappings between Alibaba Cloud accounts (Alibaba Cloud accounts or RAM users) and CDH OPEN LDAP accounts. Add the required account information as prompted on the page.

   Note

   • If you use the Presto component and select this mapping type, you must configure the Config.Properties and Presto.Jks files in the cluster's basic information.

   • Make sure that the OPEN LDAP service is enabled on the cluster.

3. Click Complete Modification to complete the configuration. Tasks submitted by an Alibaba Cloud account will then run using its mapped cluster account.