Skip to main content
TMauran
Silver ⭐️⭐️⭐️
July 23, 2024
Question

Configure HBase WebUI to redirect to Apache Knox

Hello,
I am wondering if there is any way to secure HBase with Apache Knox so that if the Knox token is not provided HBase redirects to the Knox SSO page. I managed to do it for HDFS Yarn and Spark using filters but can' t seem to find any way to do that with HBase.

```

<property>
<name>hadoop.http.authentication.type</name>
<value>org.apache.hadoop.security.authentication.server.JWTRedirectAuthenticationHandler</value>
</property>

<property>
<name>hadoop.http.authentication.authentication.provider.url</name>
<value>https://<knox-host>:8443/gateway/knoxsso/api/v1/websso</value>
</property>

<property>
<name>hadoop.http.authentication.public.key.pem</name>
<value><Your public token from the .pem file></value>
</property>
```
Here is what I added in core-site.xml to protect HDFS and Yarn.

Thank you for your time

4 replies

shubham_sharma
Gold ⭐️⭐️⭐️
Gold ⭐️⭐️⭐️
July 23, 2024

Hi @TMauran 

Could you please try to use below in hbase-site.xml and check -

<property>
<name>hbase.http.filter.initializers</name>
<value>org.apache.hadoop.security.AuthenticationFilterInitializer</value>
</property>

Other properties should be present in core-site.xml as well 

Translate
TMauran
TMauranAuthor
Silver ⭐️⭐️⭐️
July 24, 2024

Hello @shubham_sharma 
Thank you very much for taking the time, I currently run under 2.3.5 and I can' t use this filter, is this ability to redirect to Knox with the AuthenticationFilterInitializer only available since 3.0.0 ?

Translate
JeffLawson
Silver ⭐️
July 24, 2024

@TMauran wrote:

Hello,
I am wondering if there is any way to secure HBase with Apache Knox so that if the Knox token is not provided HBase redirects to the Knox SSO page. I managed to do it for HDFS Yarn and Spark using filters but can' t seem to find any way to do that with HBase.

```

<property>
<name>hadoop.http.authentication.type</name>
<value>org.apache.hadoop.security.authentication.server.JWTRedirectAuthenticationHandler</value>
</property>

<property>
<name>hadoop.http.authentication.authentication.provider.url</name>
<value>https://<knox-host>:8443/gateway/knoxsso/api/v1/websso</value>
</property>

<property>
<name>hadoop.http.authentication.public.key.pem</name>
<value><Your public token from the .pem file></value>
</property>
```
Here is what I added in core-site.xml to protect HDFS and Yarn.

Thank you for your time


To secure HBase with Apache Knox and ensure redirection to the Knox SSO page when the token is missing, configure HBase's HTTP authentication properties using the JWTRedirectAuthenticationHandler. This can be set up similarly to your HDFS, Yarn, and Spark configurations, specifying the authentication type, provider URL, and public key.

Translate
TMauran
TMauranAuthor
Silver ⭐️⭐️⭐️
July 24, 2024

Hello @JeffLawson 
I tried using this JWTRedirectAuthenticationHandler but didn' t had any  result, do you know that param name is it in the hbase-site.xml ?

Translate