Simple Authentication for Hadoop

By default Hadoop HTTP web-consoles (JobTracker, NameNode, TaskTrackers and DataNodes) allow access without any form of authentication.

The next section describes how to configure Hadoop HTTP web-consoles to require user authentication.

# Configuration

The following properties should be in the `core-site.xml` of all the nodes in the cluster.

<property>
          <name>hadoop.http.filter.initializers</name>
          <value>org.apache.hadoop.security.AuthenticationFilterInitializer</value>
          <description>
                        Authentication for Hadoop HTTP web-consoles
                        add to this property the org.apache.hadoop.security.AuthenticationFilterInitializer initializer class.
          </description>
        </property>
        <property>
          <name>hadoop.http.authentication.type</name>
          <value>pers.louyj.utils.hadoop.auth.ext.StandardAuthenticationHandler</value>
          <description>
                        Defines authentication used for the HTTP web-consoles. 
                        The supported values are: simple | kerberos | #AUTHENTICATION_HANDLER_CLASSNAME#. 
                        The dfeault value is simple.
          </description>
        </property>
        <property>
          <name>hadoop.http.authentication.token.validity</name>
          <value>36000</value>
          <description>
                        Indicates how long (in seconds) an authentication token is valid before it has to be renewed. 
                        The default value is 36000.
          </description>
        </property>
        <property>
          <name>hadoop.http.authentication.standard.config.path</name>
          <value>/home/hadoop/hadoop-2.6.4/auth.conf</value>
          <description>
                        The signature secret file for signing the authentication tokens. 
                        The same secret should be used for all nodes in the cluster, JobTracker, NameNode, DataNode and TastTracker. 
                        The default value is $user.home/hadoop-http-auth-signature-secret. 
                        IMPORTANT: This file should be readable only by the Unix user running the daemons.
          </description>
        </property>
        <property>
          <name>hadoop.http.authentication.cookie.domain</name>
          <value></value>
          <description>
                        The domain to use for the HTTP cookie that stores the authentication token. 
                        In order to authentiation to work correctly across all nodes in the cluster the domain must be correctly set. 
                        There is no default value, the HTTP cookie will not have a domain working only with the hostname issuing the HTTP cookie.

IMPORTANT: when using IP addresses, browsers ignore cookies with domain settings. 
                        For this setting to work properly all nodes in the cluster must be configured to generate URLs with hostname.domain names on it.
          </description>
        </property>
        <property>
          <name>hadoop.http.authentication.simple.anonymous.allowed</name>
          <value>false</value>
          <description>
                         Indicates if anonymous requests are allowed when using ‘simple’ authentication. 
                         The default value is true
          </description>
        </property>
       <property>
          <name>hadoop.http.authentication.signature.secret.file</name>
          <value>/home/hadoop/hadoop-2.6.4/hadoop-http-auth-signature-secret</value>
          <description>
                        The signature secret file for signing the authentication tokens. 
                        The same secret should be used for all nodes in the cluster, JobTracker, NameNode, DataNode and TastTracker. 
                        The default value is $user.home/hadoop-http-auth-signature-secret. 
                        IMPORTANT: This file should be readable only by the Unix user running the daemons.
          </description>
        </property>

add signature file

vi /home/hadoop/hadoop-2.6.4/hadoop-http-auth-signature-secret
     user
     
add auth config file

vi /home/hadoop/hadoop-2.6.4/auth.conf
    user password
 
visit web ui

http://host:port?user.name=xxxxxxx&password=xxx

Navigation

Recent Posts

Friend Links