HBase Data Read/Write Example Security Authentication (Single-Cluster Scenario)

try {
   init();
   login();
   } 
catch (IOException e) {
   LOG.error("Failed to login because ", e);
   return;
}

MRS 3.5.0-LTS and later versions:

try {
	// keytab authentication (default authentication)
	login();
	// basic authentication
	// basicLogin();
} catch (IOException e) {
	LOG.error("Failed to login because ", e);
	return;
}

• MRS 3.2.0-LTS.1 version, the following code snippet belongs to the TestMain class of the com.huawei.bigdata.hbase.examples packet.

  private static void init() throws IOException {
          // Default load from conf directory
          conf = HBaseConfiguration.create();
          //In Windows environment
          String userdir = TestMain.class.getClassLoader().getResource("conf").getPath() + File.separator;[1]
          //In Linux environment
          //String userdir = System.getProperty("user.dir") + File.separator + "conf" + File.separator;
          conf.addResource(new Path(userdir + "core-site.xml"), false);
          conf.addResource(new Path(userdir + "hdfs-site.xml"), false);
          conf.addResource(new Path(userdir + "hbase-site.xml"), false);
  }

  [1] userdir obtains the conf directory in the resource path after compilation. Save the core-site.xml, hdfs-site.xml, and hbase-site.xml configuration files required for initialization and the user credential file used for security authentication to the src/main/resources directory.

• MRS 3.5.0-LTS and later versions, the following code snippet belongs to the Utils.java class of the com.huawei.hadoop.security packet.
  In the login() or basicLogin() method, use conf = Utils.createClientConf() to initialize the configuration.

  public static Configuration createClientConf() {
  	// In Windows environment
  	String userDir = Utils.class.getClassLoader().getResource(CONF_DIRECTORY).getPath() + File.separator;
  	// In Linux environment
  	// String userDir = System.getProperty("user.dir") + File.separator + CONF_DIRECTORY + File.separator;
  	return createConfByUserDir(userDir);
  }
  
  public static Configuration createConfByUserDir(String userDir) {
  	// Default load from conf directory
  	Configuration conf = HBaseConfiguration.create();
  	if (userDir == null || userDir.isEmpty()) {
  		return conf;
  	}
  	conf.addResource(new Path(userDir + CLIENT_CORE_FILE), false);
  	conf.addResource(new Path(userDir + CLIENT_HDFS_FILE), false);
  	conf.addResource(new Path(userDir + CLIENT_HBASE_FILE), false);
  	return conf;
  }

  userDir indicates the conf directory in the compiled resource path.

• Logging In to the System Using the keytab File for Security Authentication
  • MRS 3.2.0-LTS.1 version

    Set userName to the actual username based on the actual situation, for example, developuser.

    On Windows and Linux, use the corresponding path obtaining mode.

    private static void login() throws IOException {
            if (User.isHBaseSecurityEnabled(conf)) {
                userName = "hbaseuser1";
               
                //In Windows environment
                String userdir = TestMain.class.getClassLoader().getResource("conf").getPath() + File.separator;
                //In Linux environment
                //String userdir = System.getProperty("user.dir") + File.separator + "conf" + File.separator;
     
                /*
                 * if need to connect zk, please provide jaas info about zk. of course,
                 * you can do it as below:
                 * System.setProperty("java.security.auth.login.config", confDirPath +
                 * "jaas.conf"); but the demo can help you more : Note: if this process
                 * will connect more than one zk cluster, the demo may be not proper. you
                 * can contact us for more help
                 */
                LoginUtil.setJaasConf(ZOOKEEPER_DEFAULT_LOGIN_CONTEXT_NAME, userName, userKeytabFile);
                LoginUtil.login(userName, userKeytabFile, krb5File, conf);
            }
    }

  • MRS 3.5.0-LTS and later versions

    Modify the following parameters in the TestMain class of the com.huawei.bigdata.hbase.examples package based on the site requirements:

    • Change the value of userName to the username you actually use, for example, hbaseuser.
    • Change the value of ZOOKEEPER_DEFAULT_SERVER_PRINCIPAL to zookeeper/hadoop.Cluster domain name. To obtain the value of cluster domain name, log in to FusionInsight Manager, choose System > Permission > Domain and Mutual Trust, and view the value of Local Domain.

    private static final String USER_NAME = "hbaseuser";
    private static void login() throws IOException {
    	conf = Utils.createClientConf();
    	if (User.isHBaseSecurityEnabled(conf)) {
    		// In Windows environment
    		String userDir = TestMain.class.getClassLoader().getResource(Utils.CONF_DIRECTORY).getPath() + File.separator;
    		// In Linux environment
    		// String userDir = System.getProperty("user.dir") + File.separator + Utils.CONF_DIRECTORY + File.separator;
    
    		String userKeytabFile = userDir + USER_KEYTAB_FILE;
    		String krb5File = userDir + KRB5_CONF_FILE;
    		/*
    		 * if need to connect zk, please provide jaas info about zk. of course,
    		 * you can do it as below:
    		 * System.setProperty("java.security.auth.login.config", confDirPath +
    		 * "jaas.conf"); but the demo can help you more : Note: if this process
    		 * will connect more than one zk cluster, the demo may be not proper. you
    		 * can contact us for more help
    		 */
    		LoginUtil.setJaasConf(ZOOKEEPER_DEFAULT_LOGIN_CONTEXT_NAME, USER_NAME, userKeytabFile);
    		LoginUtil.setZookeeperServerPrincipal(ZOOKEEPER_SERVER_PRINCIPAL_KEY, ZOOKEEPER_DEFAULT_SERVER_PRINCIPAL);
    		LoginUtil.login(USER_NAME, userKeytabFile, krb5File, conf);
    	}
    }

• Logging In to the System Using Basic Authentication (MRS 3.6.0-LTS and later versions)
  • Enable the HBase Basic authentication. For details, see section Enabling the HBase Basic Authentication.
  • Note that Basic authentication is not supported for Thrift, REST, Phoenix connections and open-source clients.

  private static void basicLogin() throws IOException {
  	conf = Utils.createClientConf();
  	if (User.isHBaseSecurityEnabled(conf)) {
  		UserGroupInformation.setConfiguration(conf);
  		/*
  		  Set basic auth configurations
  		 */
  		conf.set("hbase.basic.auth.username", "hbaseuser");
  		conf.set("hbase.basic.auth.password", "xxxxx");
  	}
  }

  hbase.basic.auth.username indicates the username for Basic authentication, and hbase.basic.auth.password indicates the user password.