Created 01-23-2016 04:04 AM
I am wanting to be able to automatically authenticate a Windows users that is in Active Directory through an app that is using an ODBC connection. So for example with MSSQL Server when I login to Windows with my AD account and I pull up SQL Server Developer Studio I get an option to use "Windows Authentication" (e.g. http://i.stack.imgur.com/Zl876.png). I would like to do this same exact thing through my application, except to Hive/HDFS/etc. I found this article https://github.com/abajwa-hw/security-workshops/blob/master/Setup-knox-23.md where I could use Knox/Ranger to authenticate to the AD but it still requires the user to put in their login information. Is it possible to do what I am asking? Or is it only possible to require the user to put in their login information to the AD again?
Created 01-23-2016 04:34 AM
I believe you are asking for SSO, Single Sign On.
SSO and Knox integration works. http://hortonworks.com/blog/hadoop-security-today-and-tomorrow/
Perimeter level Security With Apache Knox Apache Hadoop has Kerberos for authentication. However, some organizations require integration with their enterprise identity management and Single Sign-On (SSO) solutions. Hortonworks created Apache Knox Gateway (Apache Knox) to provide Hadoop cluster security at the perimeter for REST/HTTP requests and to enable the integration of enterprise identity-management solutions. Apache Knox provides integration with corporate identity systems such as LDAP, Active Directory (AD) and will also integrate with SAML based SSO and other SSO systems.
Apache Knox also protects a Hadoop cluster by hiding its network topology to eliminate the leak of network internals. A network firewall may be configured to deny all direct access to a Hadoop cluster and accept only the connections coming from the Apache Knox Gateway over HTTP. These measures dramatically reduce the attack vector.
Finally, Apache Knox promotes the use of REST/HTTP for Hadoop access. REST is proven, scalable, and provides client interoperability across languages, operating systems, and computing devices. By using Hadoop REST/HTTP APIs through Knox, clients do not need a local Hadoop installation.
Created 02-02-2016 05:10 PM
@Kevin Vasko has this been resolved? Can you accept the best answer or provide your own solution?