Ambari SSO

[#1]

Working with AD integration with LDAP and wondering if Ambari can use existing kerberos ticket instead of an explicit login. This is an AD where users don't have passwords but hardware key based passcodes. Once they login to their system, they have a valid kerberos ticket from AD. Can this be used instead of asking user to login?

[#2 · Accepted solution]

@Ravi Mutyala

Currently Ambari cannot use a Kerberos ticket for authentication. This seems to becoming a popular topic, so I assume in some future version the feature will be added - either in Ambari itself or via Knox.

Regarding SSO... I believe (but I am not totally certain) that in Ambari 2.4.0 there are some SSO integration points. I am not sure of all the details but hopefully when the docs come out they describe this feature.

[#3]

Thanks. If you already have a jira for this, please post so we can keep track.

[#4]

In a recently released version Apache Knox an SSO API was added. You can find more info on it here:

User Guide:

https://knox.apache.org/books/knox-0-9-0/user-guide.html#KnoxSSO+Setup+and+Configuration

Dev Guide

https://knox.apache.org/books/knox-0-9-0/dev-guide.html#KnoxSSO+Integration

[#5]

@zblanco can knox sso use an existing kerberos ticket to authenticate?

[#6]

In theory, the hadoop-auth provider in Knox could be used with KnoxSSO in order to accept the kerberos ticket. It would assume that the kerberos ticket would be presented to Knox via the SPNEGO challenge from hadoop-auth and that the result would be a ticket that for Knox and from the same realm or a trusted realm as Knox is configured for. There are a good number of maybe's in there and it is certainly not something that has been tested.

I would be interested in hearing the results.

Again, this has not been tested and is not a supported usecase for HDP.