Creating a Kerberos Datasource Authentication

Updated on 2024-09-30 GMT+08:00

View PDF

Scenario

Create a Kerberos datasource authentication on the DLI console to store the authentication information of the data source to DLI. This will allow you to access to the data source without having to configure a username and password in SQL jobs.

NOTE:

When Kerberos authentication is enabled for MRS Kafka but SSL authentication is disabled, create a Kerberos authentication. When creating a table, configure krb_auth_name to associate the datasource authentication.
If Kerberos authentication and SSL authentication are both enabled for MRS Kafka, you need to create Kerberos and Kafka_SSL authentications. When creating a table, configure krb_auth_name and ssl_auth_name to associate the datasource authentications.
Datasource authentication is not required when Kerberos authentication is disabled but SASL authentication is enabled for MRS Kafka (for example, when a username and a password are used for PlainLoginModule authentication).
When Kerberos authentication is disabled but SSL authentication is enabled for MRS Kafka, you need to create a Kafka_SSL authentication. When creating a table, configure ssl_auth_name to associate the datasource authentication.
When Kerberos authentication is disabled but SASL authentication and SSL authentication are enabled for MRS Kafka, you need to create a Kafka_SSL authentication. When creating a table, configure ssl_auth_name to associate the datasource authentication.

Data Sources Supported by Kerberos Datasource Authentication

Table 1 lists the data sources supported by Kerberos datasource authentication.

**Table 1** Data sources supported by Kerberos datasource authentication
Job Type	Table Type	Data Source	Notes and Constraints
Flink OpenSource SQL	Source table	HBase	Kerberos authentication has been enabled for the MRS cluster.
	Source table	Kafka	Kerberos authentication has been enabled for MRS Kafka.
	Result table	HBase	Kerberos authentication has been enabled for the MRS cluster.
	Result table	Kafka	Kerberos authentication has been enabled for MRS Kafka.
	Dimension table	HBase	Kerberos authentication has been enabled for the MRS cluster.

Procedure

Download the authentication credential of the data source.
1. Log in to MRS Manager.
2. Choose System > Permission > User.
3. Click More, select Download Authentication Credential, save the file, and decompress it to obtain the keytab and krb5.conf files.
Upload the authentication credential to the OBS bucket.

Create a datasource authentication.

Log in to the DLI management console.
Choose Datasource Connections. On the page displayed, click Datasource Authentication.

Click Create.

Configure Kerberos authentication parameters according to Table 2.

**Table 2** Parameters
Parameter	Description
Type	Select Kerberos.
Authentication Certificate	Name of the datasource authentication to be created. The name can contain only digits, letters, and underscores (_), but cannot contain only digits or start with an underscore (_). The name can contain a maximum of 128 characters. It is recommended that the name contain the MRS security cluster name to distinguish security authentication information of different clusters.
Username	Username for logging in to the security cluster.
krb5_conf Path	OBS path to which the krb5.conf file is uploaded. NOTE: The renew_lifetime configuration item under [libdefaults] must be removed from krb5.conf. Otherwise, the "Message stream modified (41)" error may occur.
keytab Path	OBS path to which the user.keytab file is uploaded.

Figure 1 Creating a datasource authentication – Kerberos

Create a table to access the MRS cluster.

When creating a data source, associate the data source with the created datasource authentication to access the data source.

Table 3 lists the fields used to associate with the datasource authentication during table creation.

**Table 3** Fields that are used to associate with Kerberos datasource authentication during table creation
Job Type	Data Source	Parameter	Mandatory	Data Type	Description
Flink OpenSource SQL	HBase	krb_auth_name	No	String	This field is used to associate datasource authentications when source, result, and dimension tables are created.
Flink OpenSource SQL	Kafka	krb_auth_name	No	String	This field is used to associate datasource authentications when source and result tables are created. Name of the created Kerberos datasource authentication. If SASL_PLAINTEXT and Kerberos authentication are both used, you need to configure the following parameters: 'properties.sasl.mechanism' = 'GSSAPI' 'properties.security.protocol' = 'SASL_PLAINTEXT'