Kerberos authentication on Cloud for Data Virtualization
Kerberos autenticación en la nube para Data Virtualization
Última actualización: 17 mar 2025
Kerberos autenticación en la nube para Data Virtualization
Para conectarse a Apache Hive, Apache Impala y Apache Spark SQL con autenticación Kerberos , debe proporcionar el archivo de configuración Kerberos a Data Virtualization antes de crear la conexión.
Kerberos es un protocolo de autenticación de seguridad de redes informáticas sin contraseña que creó el MIT para resolver problemas de seguridad de redes. Hoy en día, muchas organizaciones lo utilizan ampliamente para el inicio de sesión único (SSO), transmitiendo de forma segura los datos de identidad del usuario a las aplicaciones con dos funciones principales: autenticación y seguridad.
Data Virtualization on-premises admite la autenticación Kerberos para Apache Hive, Apache Impala y Apache Spark SQL y requiere que el usuario cargue un archivo keytab o un archivo cifrado que genera el origen de datos, y se utiliza para la autenticación mediante Kerberos.
Nota : La autenticación de Kerberos no está disponible en el Data Virtualization cliente web debido a una restricción de carga de archivos.
Procedimiento
Para cada una de sus fuentes de datos Apache Hive, Apache Impala y Apache Spark SQL , abra un nuevo archivo de texto y, a continuación, siga los pasos siguientes para crear un archivo de configuración.
Copie y pegue la siguiente información en su nuevo archivo de texto, luego modifique las variables, como se indica mediante los corchetes triangulares (< >).
# To opt out of the system crypto-policies configuration of krb5, remove the
# symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated.
includedir /etc/krb5.conf.d/
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
spake_preauth_groups = edwards25519
dns_canonicalize_hostname = fallback
qualify_shortname = ""
default_realm = <DEFAULT_DOMAIN_REALM>
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
<KERBEROS_REALM> = {
kdc = <KDC_SERVER>
admin_server = <ADMIN_SERVER>
}
[domain_realm]
<SUBDOMAIN_REALM> = <DOMAIN_REALM><DOMAIN_TO_REALM> = <SUBDOMAIN_TO_REALM>
Considere el siguiente texto como ejemplo.
# To opt out of the system crypto-policies configuration of krb5, remove the
# symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated.
includedir /etc/krb5.conf.d/
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
spake_preauth_groups = edwards25519
dns_canonicalize_hostname = fallback
qualify_shortname = ""
default_realm = EXAMPLE.COM
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
EXAMPLE.COM = {
kdc = kerberos.example.com
admin_server = kerberos.example.com
}
[domain_realm]
.example.com = EXAMPLE.COM
example.com = EXAMPLE.COM
Guarde el archivo de configuración.
Para Apache Hive, guarde el archivo como hive_krb5.conf.
Para Apache Impala, guarde el archivo como Impala_krb5.conf.
Para Apache Spark SQL, guarde el archivo como spark_krb5.conf.
Abra el archivo datavirtualization.env en su agente remoto.
vi /root/dv_endpoint/datavirtualization.env
Verifique que el contenido del archivo datavirtualization.env contenga la siguiente información.
JAVA_HOME: Esta es la ruta donde Java está instalado en su máquina.
DATAVIRTUALIZATION_INSTALL: Esta es la ruta de archivo para datavirtualization.env.
KRB5_CONFIG: Esta es la ruta de archivo de su archivo de configuración de krb5.conf recién creado.
El siguiente es un ejemplo del texto que podría contener su archivo.
JAVA_HOME="/root/jdk-21.0.3+9"
DATAVIRTUALIZATION_INSTALL="/root/dv_endpoint"
KRB5_CONFIG=/etc/hive_krb5.conf
Reemplace los parámetros en este procedimiento almacenado y luego ejecútelo en Ejecutar SQL. Además, sustituya <Data_source> por Hive, Impala o SparkSQL.
Compruebe si el procedimiento almacenado se ha realizado correctamente seleccionando la pestaña Resultados y, a continuación, comprobando la columna Valor de salida.
Una salida correcta tiene un entero de 1.
Una salida fallida tiene un entero de 0. Verifique de nuevo los pasos de configuración anteriores.
¿Fue útil el tema?
0/1000
Focus sentinel
Focus sentinel
Focus sentinel
Focus sentinel
Focus sentinel
Cloud Pak for Data relationship map
Use this interactive map to learn about the relationships between your tasks, the tools you need, the services that provide the tools, and where you use the tools.
Select any task, tool, service, or workspace
You'll learn what you need, how to get it, and where to use it.
Tasks you'll do
Some tasks have a choice of tools and services.
Tools you'll use
Some tools perform the same tasks but have different features and levels of automation.
Create a notebook in which you run Python, R, or Scala code to prepare, visualize, and analyze data, or build a model.
Automatically analyze your tabular data and generate candidate model pipelines customized for your predictive modeling problem.
Create a visual flow that uses modeling algorithms to prepare data and build and train a model, using a guided approach to machine learning that doesn’t require coding.
Create and manage scenarios to find the best solution to your optimization problem by comparing different combinations of your model, data, and solutions.
Create a flow of ordered operations to cleanse and shape data. Visualize data to identify problems and discover insights.
Automate the model lifecycle, including preparing data, training models, and creating deployments.
Work with R notebooks and scripts in an integrated development environment.
Create a federated learning experiment to train a common model on a set of remote data sources. Share training results without sharing data.
Deploy and run your data science and AI solutions in a test or production environment.
Find and share your data and other assets.
Import asset metadata from a connection into a project or a catalog.
Enrich imported asset metadata with business context, data profiling, and quality assessment.
Measure and monitor the quality of your data.
Create and run masking flows to prepare copies of data assets that are masked by advanced data protection rules.
Create your business vocabulary to enrich assets and rules to protect data.
Track data movement and usage for transparency and determining data accuracy.
Track AI models from request to production.
Create a flow with a set of connectors and stages to transform and integrate data. Provide enriched and tailored information for your enterprise.
Create a virtual table to segment or combine data from one or more tables.
Measure outcomes from your AI models and help ensure the fairness, explainability, and compliance of all your models.
Replicate data to target systems with low latency, transactional integrity and optimized data capture.
Consolidate data from the disparate sources that fuel your business and establish a single, trusted, 360-degree view of your customers.
Services you can use
Services add features and tools to the platform.
Develop powerful AI solutions with an integrated collaborative studio and industry-standard APIs and SDKs. Formerly known as Watson Studio.
Quickly build, run and manage generative AI and machine learning applications with built-in performance and scalability. Formerly known as Watson Machine Learning.
Discover, profile, catalog, and share trusted data in your organization.
Create ETL and data pipeline services for real-time, micro-batch, and batch data orchestration.
View, access, manipulate, and analyze your data without moving it.
Monitor your AI models for bias, fairness, and trust with added transparency on how your AI models make decisions.
Provide efficient change data capture and near real-time data delivery with transactional integrity.
Improve trust in AI pipelines by identifying duplicate records and providing reliable data about your customers, suppliers, or partners.
Increase data pipeline transparency so you can determine data accuracy throughout your models and systems.
Where you'll work
Collaborative workspaces contain tools for specific tasks.
Where you work with data.
> Projects > View all projects
Where you find and share assets.
> Catalogs > View all catalogs
Where you deploy and run assets that are ready for testing or production.
> Deployments
Where you manage governance artifacts.
> Governance > Categories
Where you virtualize data.
> Data > Data virtualization
Where you consolidate data into a 360 degree view.