question Re: Configure HBase WebUI to redirect to Apache Knox in Support Questions

Configure HBase WebUI to redirect to Apache Knox

TMauran — Tue, 23 Jul 2024 07:08:08 GMT

Hello,
I am wondering if there is any way to secure HBase with Apache Knox so that if the Knox token is not provided HBase redirects to the Knox SSO page. I managed to do it for HDFS Yarn and Spark using filters but can' t seem to find any way to do that with HBase.

```

<property>
<name>hadoop.http.authentication.type</name>
<value>org.apache.hadoop.security.authentication.server.JWTRedirectAuthenticationHandler</value>
</property>

<property>
<name>hadoop.http.authentication.authentication.provider.url</name>
<value>https://<knox-host>:8443/gateway/knoxsso/api/v1/websso</value>
</property>

<property>
<name>hadoop.http.authentication.public.key.pem</name>
<value><Your public token from the .pem file></value>
</property>
```
Here is what I added in core-site.xml to protect HDFS and Yarn.

Thank you for your time

Re: Configure HBase WebUI to redirect to Apache Knox

shubham_sharma — Tue, 23 Jul 2024 17:39:09 GMT

Hi @TMauran

Could you please try to use below in hbase-site.xml and check -

<property> 
<name>hbase.http.filter.initializers</name> 
<value>org.apache.hadoop.security.AuthenticationFilterInitializer</value> 
</property>

Other properties should be present in core-site.xml as well

Re: Configure HBase WebUI to redirect to Apache Knox

TMauran — Wed, 24 Jul 2024 06:56:29 GMT

Hello @shubham_sharma
Thank you very much for taking the time, I currently run under 2.3.5 and I can' t use this filter, is this ability to redirect to Knox with the AuthenticationFilterInitializer only available since 3.0.0 ?

Re: Configure HBase WebUI to redirect to Apache Knox

JeffLawson — Wed, 24 Jul 2024 08:14:50 GMT

@TMauran wrote:
Hello,
I am wondering if there is any way to secure HBase with Apache Knox so that if the Knox token is not provided HBase redirects to the Knox SSO page. I managed to do it for HDFS Yarn and Spark using filters but can' t seem to find any way to do that with HBase.

```
<property>
<name>hadoop.http.authentication.type</name>
<value>org.apache.hadoop.security.authentication.server.JWTRedirectAuthenticationHandler</value>
</property>
<property>
<name>hadoop.http.authentication.authentication.provider.url</name>
<value>https://<knox-host>:8443/gateway/knoxsso/api/v1/websso</value>
</property>
<property>
<name>hadoop.http.authentication.public.key.pem</name>
<value><Your public token from the .pem file></value>
</property>
```
Here is what I added in core-site.xml to protect HDFS and Yarn.

Thank you for your time

To secure HBase with Apache Knox and ensure redirection to the Knox SSO page when the token is missing, configure HBase's HTTP authentication properties using the JWTRedirectAuthenticationHandler. This can be set up similarly to your HDFS, Yarn, and Spark configurations, specifying the authentication type, provider URL, and public key.

Re: Configure HBase WebUI to redirect to Apache Knox

TMauran — Wed, 24 Jul 2024 08:47:47 GMT

Hello @JeffLawson
I tried using this JWTRedirectAuthenticationHandler but didn' t had any result, do you know that param name is it in the hbase-site.xml ?