Configuring Lily HBase Indexer to Use Security

To configure the Lily HBase Indexer to use security, you must create principals and keytabs and then modify default configurations.

To create principals and keytabs

Repeat this process on all Lily HBase Indexer hosts.

1. Create a Lily HBase Indexer service user principal using the syntax: hbase/<fully.qualified.domain.name>@<YOUR-REALM>. This principal is used to authenticate with the Hadoop cluster. where: fully.qualified.domain.name is the host where the Lily HBase Indexer is running YOUR-REALM is the name of your Kerberos realm.

   $ kadmin
   kadmin: addprinc -randkey hbase/fully.qualified.domain.name@YOUR-REALM.COM

2. Create a HTTP service user principal using the syntax: HTTP/<fully.qualified.domain.name>@<YOUR-REALM>. This principal is used to authenticate user requests coming to the Lily HBase Indexer web-services. where: fully.qualified.domain.name is the host where the Lily HBase Indexer is running YOUR-REALM is the name of your Kerberos realm.

   kadmin: addprinc -randkey HTTP/fully.qualified.domain.name@YOUR-REALM.COM

     Note:

   The HTTP/ component of the HTTP service user principal must be upper case as shown in the syntax and example above.

3. Create keytab files with both principals.

   kadmin: xst -norandkey -k hbase.keytab hbase/fully.qualified.domain.name \
   HTTP/fully.qualified.domain.name

4. Test that credentials in the merged keytab file work. For example:

   $ klist -e -k -t hbase.keytab

5. Copy the hbase.keytab file to the Lily HBase Indexer configuration directory. The owner of the hbase.keytab file should be the hbase user and the file should have owner-only read permissions.

To modify default configurations

Repeat this process on all Lily HBase Indexer hosts.

1. Modify the hbase-indexer-site.xml file as follows:

     <property>
       <name>hbaseindexer.authentication.type</name>
       <value>kerberos</value>
     </property>
     <property>
       <name>hbaseindexer.authentication.kerberos.keytab</name>
       <value>hbase.keytab</value>
     </property>
     <property>
       <name>hbaseindexer.authentication.kerberos.principal</name>
       <value>HTTP/localhost@LOCALHOST</value>
     </property>
     <property>
       <name>hbaseindexer.authentication.kerberos.name.rules</name>
       <value>DEFAULT</value>
     </property>

2. Set up the Java Authentication and Authorization Service (JAAS). Create a jaas.conf file in the HBase-Indexer configuration directory containing the following settings. Make sure that you substitute a value for principal that matches your particular environment.

   Client {
     com.sun.security.auth.module.Krb5LoginModule required
     useKeyTab=true
     useTicketCache=false
     keyTab="/etc/hbase/conf/hbase.keytab"
     principal="hbase/fully.qualified.domain.name@<YOUR-REALM>";
   };

   Then, modify hbase-indexer-env.sh in the hbase-indexer configuration directory to add the jaas configuration to the system properties. You can do this by adding -Djava.security.auth.login.config to the HBASE_INDEXER_OPTS. For example, you might add the following:

   HBASE_INDEXER_OPTS = "$HBASE_INDEXER_OPTS -Djava.security.auth.login.config=/path/to/your/jaas.conf"

Sentry integration

The Lily HBase Indexer uses a file-based access control model similar to that provided by Solr-Sentry integration, which is described in Configuring Sentry Authorization for Solr. For details on configuring the HTTP API, which Sentry requires, see Configuring Clients to Use the HTTP Interface. The Lily HBase Indexer's file-based access control model supports specifying READ and WRITE privileges for each indexer. The privileges work as follows:

• If role has WRITE privilege for indexer1, a call to create, update, or delete indexer1 succeeds.
• If role has READ privilege for indexer1, a call to list-indexers will list indexer1, if it exists. If an indexer called indexer2 exists, but the role does not have READ privileges for it, information about indexer2 is filtered out of the response.

To configure Sentry for the Lily HBase Indexer, add the following properties to hbase-indexer-site.xml:

  <property>
    <name>sentry.hbaseindexer.sentry.site</name>
    <value>sentry-site.xml</value> (full or relative path)
  </property>
  <property>
    <name>hbaseindexer.rest.resource.package</name>
    <value>org/apache/sentry/binding/hbaseindexer/rest</value>
  </property>

  Note: These settings can be added using Cloudera Manager or by manually editing the hbase-indexer-site.xml file.

You can use the Cloudera Manager GUI to start Lily HBase NRT Indexer Service on a set of machines. In non-managed deployments, you can start a Lily HBase Indexer Daemon manually on the local host with the following command:

sudo service hbase-solr-indexer restart

After starting the Lily HBase NRT Indexer Services, verify that all daemons are running using the jps tool from the Oracle JDK, which you can obtain from the Java SE Downloads page. If you are running a pseudo-distributed HDFS installation and a Lily HBase NRT Indexer Service installation on one machine, jps shows the following output:

$ sudo jps -lm
31407 sun.tools.jps.Jps -lm
26393 com.ngdata.hbaseindexer.Main