Support Questions
Find answers, ask questions, and share your expertise
Announcements
Alert: Welcome to the Unified Cloudera Community. Former HCC members be sure to read and learn how to activate your account here.

Cloudera Security issue with Sentry

Solved Go to solution

Cloudera Security issue with Sentry

New Contributor

Hi,

Me and my coworkers are trying to implement security with Sentry in a Cloudera Cluster (CDH 5.10.0), without success.
It's our first hadoop project, a PoC for a customer. Our main security requirement is grant/revoke select access to schemas/tables for HUE users.
Firstly, we setup a KDC server for Kerberos in order to centralize authentication then we followed the "Enable Kerberos" wizard in Cloudera Manager. Everything works fine.
After that, we added the Sentry Service then we followed the documentation to configure all services (in our case, HDFS, Hive, Hue).
All these services are up and running, but the HUE admin user doesn't have permission to manage permissions in Security App.

After a lot of changes in configuration and after reading the entire security section in Cloudera Documentation, we didn't reach our goal.

We don't understand how to manage users/permissions in hadoop ecossytem.
How hue users, cloudera manager users, apps/system users (hue, hive, hdfs), kerberos principals, HDFS permissions and Sentry are related in order to work properly?

 

1 ACCEPTED SOLUTION

Accepted Solutions

Re: Cloudera Security issue with Sentry

Champion
Well, that topic is pretty broad. Let me try to help get you going.

Hadoop and all the tools that run on it will use Kerberos authentication now that it is configured.
User and group mappings will still be handled at the OS level though. So if you do not have LDAP and have it integrated at the OS level you will need to create local users and groups in the OS on all nodes.
Second, both CM and HUE have their own auth backend configuration and authorization. You can integrate both with LDAP, if you have it, or SAML/SSO. If not, you will need to create the users in those systems as well. The HUE users need to match the first portion, the username, of the principal in the KDC.

Now for the specific item you mentioned the HUE admin not having access to the Security app. HUE has its own groups and permissions. So you will need to add that user to have access to the Security app. You will need a HUE superuser account to do this (this is probably the HUE admin you mentioned).
3 REPLIES 3

Re: Cloudera Security issue with Sentry

Champion
Well, that topic is pretty broad. Let me try to help get you going.

Hadoop and all the tools that run on it will use Kerberos authentication now that it is configured.
User and group mappings will still be handled at the OS level though. So if you do not have LDAP and have it integrated at the OS level you will need to create local users and groups in the OS on all nodes.
Second, both CM and HUE have their own auth backend configuration and authorization. You can integrate both with LDAP, if you have it, or SAML/SSO. If not, you will need to create the users in those systems as well. The HUE users need to match the first portion, the username, of the principal in the KDC.

Now for the specific item you mentioned the HUE admin not having access to the Security app. HUE has its own groups and permissions. So you will need to add that user to have access to the Security app. You will need a HUE superuser account to do this (this is probably the HUE admin you mentioned).
Highlighted

Re: Cloudera Security issue with Sentry

New Contributor

Thanks for your explanation @mbigelow. We'll setup and integrate an LDAP server in our environment. 

Re: Cloudera Security issue with Sentry

New Contributor

Can you please explain if it is necessary, when integrating LDAP, still create users and groups on OS level or it needs for service users only such hive, impala, hdfs and etc? Whta is the role of SSSD or Centrify in this case? As I understand we can create various groups in LDAP and not in OS.

Don't have an account?
Coming from Hortonworks? Activate your account here