Administrator Guide

9.9
- 9.9.4
- 9.9.3
- 9.9.2
- 9.9.1
- 9.8.4
- 9.8.3
- 9.8.2
- 9.8.1
- 9.8.0

Back Next

Kerberos Authentication for Hive or Impala Databases

You can enable Kerberos authentication for Hive, Hive (HTTP), and Impala databases. Copy the

krb5.conf

file and the keytab file for the Dynamic Data Masking service principal to the Dynamic Data Masking Server machine. Then configure the

ddm.security

file.

For more information on Kerberos authentication for Hive and Impala, see the H2L "

Enabling Kerberos for Hive and Impala Databases in Dynamic Data Masking

Stop the Dynamic Data Masking Server.

Copy the

krb5.conf

file and the keytab file for the Dynamic Data Masking service principal to the Dynamic Data Masking Server machine.

If you have not already created an XML

ddm.security

configuration file, create the file in the following location:

<DDM>/cfg/ddm.security

Configure the

ddm.security

file as shown in the example below:

<XML>
  	<kdc>/etc/krb5.conf</kdc>

	<jaasConfig type="ArrayList">
		<entry type="JaasDescriptor">
			<fqcn>com.activebase.security.jaas.JaasProcessorImpl</fqcn>
			<configuration>
				<jaasEntries type="HashMap">
					<entry>
						<key>default</key>
						<value type="ArrayList">
							<entry type="HashMap">
								<entry>
									<key>moduleClass</key>
									<value>com.sun.security.auth.module.Krb5LoginModule</value>
								</entry>
								<entry>
									<key>moduleFlag</key>
									<value>required</value>
								</entry>
								<entry>
									<key>options</key>
									<value type="HashMap">
										<entry>
											<key>principal</key>
											<value>ddmserver/ddmhost@realm.com</value>
										</entry>
										<entry>
											<key>keyTab</key>
											<value>cfg/ddmService.keytab</value>
										</entry>
										</value>
									</entry>
								</entry>
								</value>
							</entry>
						</jaasEntries>
					</configuration>
						</entry>
					</jaasConfig>
					
					</XML>

Configure the values in the

ddm.security

file above as shown below:

For the value of the "principal" key, give the Dynamic Data Masking SPN.

For the value of the "keyTab" key, give the keytab file name with path.

If SSL authentication is enabled on the Hive or Impala server, follow the steps in Chapter 3, topics "Keystore Configuration" and "Truststore Configuration" to enable SSL for Hive or Impala services.

Rename Saved Search

Table of Contents

Administrator Guide

Administrator Guide

Kerberos Authentication for Hive or Impala Databases

Kerberos Authentication for Hive or Impala Databases