Kerberos authentication on Cloud for Data Virtualization
Kerberos authentification sur le Cloud pour Data Virtualization
Dernière mise à jour : 17 mars 2025
Kerberos authentification sur le Cloud pour Data Virtualization
Pour vous connecter à Apache Hive, Apache Impala, et Apache Spark SQL avec l'authentification Kerberos , vous devez fournir le fichier de configuration Kerberos à Data Virtualization avant de créer la connexion.
Kerberos est un protocole d'authentification de sécurité des réseaux informatiques sans mot de passe que le MIT a créé pour résoudre les problèmes de sécurité des réseaux. Il est aujourd'hui largement utilisé pour l'authentification unique (SSO) par de nombreuses organisations, transmettant en toute sécurité les données d'identité des utilisateurs aux applications avec deux fonctions principales : l'authentification et la sécurité.
Data Virtualization on-premises prend en charge l'authentification par Kerberos pour Apache Hive, Apache Impala et Apache Spark SQL . Elle nécessite que l'utilisateur télécharge un fichier keytab ou un fichier chiffré généré par la source de données, et est utilisée pour l'authentification par Kerberos.
Remarque : l'authentification par Kerberos n'est pas disponible dans le Data Virtualization client web en raison d'une restriction de téléchargement de fichiers.
Procédure
Pour chacune de vos sources de données Apache Hive, Apache Impala et Apache Spark SQL , ouvrez un nouveau fichier texte puis suivez les étapes suivantes pour créer un fichier de configuration.
Copiez et collez les informations suivantes dans votre nouveau fichier texte, puis modifiez les variables, comme indiqué par les crochets (< >).
# To opt out of the system crypto-policies configuration of krb5, remove the
# symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated.
includedir /etc/krb5.conf.d/
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
spake_preauth_groups = edwards25519
dns_canonicalize_hostname = fallback
qualify_shortname = ""
default_realm = <DEFAULT_DOMAIN_REALM>
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
<KERBEROS_REALM> = {
kdc = <KDC_SERVER>
admin_server = <ADMIN_SERVER>
}
[domain_realm]
<SUBDOMAIN_REALM> = <DOMAIN_REALM><DOMAIN_TO_REALM> = <SUBDOMAIN_TO_REALM>
Considérons le texte suivant à titre d'exemple.
# To opt out of the system crypto-policies configuration of krb5, remove the
# symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated.
includedir /etc/krb5.conf.d/
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
spake_preauth_groups = edwards25519
dns_canonicalize_hostname = fallback
qualify_shortname = ""
default_realm = EXAMPLE.COM
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
EXAMPLE.COM = {
kdc = kerberos.example.com
admin_server = kerberos.example.com
}
[domain_realm]
.example.com = EXAMPLE.COM
example.com = EXAMPLE.COM
Sauvegardez le fichier de configuration.
Pour l' Apache Hive, enregistrez le fichier sous hive_krb5.conf.
Pour l' Apache Impala, enregistrez le fichier sous Impala_krb5.conf.
Pour l' Apache Spark SQL, enregistrez le fichier sous spark_krb5.conf.
Ouvrez le fichier datavirtualization.env dans votre agent distant.
vi /root/dv_endpoint/datavirtualization.env
Vérifiez que le contenu du fichier d' datavirtualization.env s contient les informations suivantes.
JAVA_HOME: Il s'agit du chemin où Java est installé sur votre machine.
DATAVIRTUALIZATION_INSTALL: Il s'agit du chemin d'accès au fichier datavirtualization.env.
KRB5_CONFIG: Il s'agit du chemin d'accès au fichier de configuration d' krb5.conf .
Voici un exemple du texte que votre fichier pourrait contenir.
JAVA_HOME="/root/jdk-21.0.3+9"
DATAVIRTUALIZATION_INSTALL="/root/dv_endpoint"
KRB5_CONFIG=/etc/hive_krb5.conf
Remplacez les paramètres dans cette procédure stockée, puis exécutez-la dans Exécuter SQL. De plus, remplacez <Data_source> par Hive, Impala ou SparkSQL.
Vérifiez si la procédure stockée a réussi en sélectionnant l'onglet Résultats, puis en vérifiant la colonne Valeur de sortie.
Une sortie réussie a un entier de 1.
Une sortie infructueuse a un entier de 0. Vérifiez à nouveau les étapes de configuration précédentes.
La rubrique a-t-elle été utile ?
0/1000
Focus sentinel
Focus sentinel
Focus sentinel
Focus sentinel
Focus sentinel
Cloud Pak for Data relationship map
Use this interactive map to learn about the relationships between your tasks, the tools you need, the services that provide the tools, and where you use the tools.
Select any task, tool, service, or workspace
You'll learn what you need, how to get it, and where to use it.
Tasks you'll do
Some tasks have a choice of tools and services.
Tools you'll use
Some tools perform the same tasks but have different features and levels of automation.
Create a notebook in which you run Python, R, or Scala code to prepare, visualize, and analyze data, or build a model.
Automatically analyze your tabular data and generate candidate model pipelines customized for your predictive modeling problem.
Create a visual flow that uses modeling algorithms to prepare data and build and train a model, using a guided approach to machine learning that doesn’t require coding.
Create and manage scenarios to find the best solution to your optimization problem by comparing different combinations of your model, data, and solutions.
Create a flow of ordered operations to cleanse and shape data. Visualize data to identify problems and discover insights.
Automate the model lifecycle, including preparing data, training models, and creating deployments.
Work with R notebooks and scripts in an integrated development environment.
Create a federated learning experiment to train a common model on a set of remote data sources. Share training results without sharing data.
Deploy and run your data science and AI solutions in a test or production environment.
Find and share your data and other assets.
Import asset metadata from a connection into a project or a catalog.
Enrich imported asset metadata with business context, data profiling, and quality assessment.
Measure and monitor the quality of your data.
Create and run masking flows to prepare copies of data assets that are masked by advanced data protection rules.
Create your business vocabulary to enrich assets and rules to protect data.
Track data movement and usage for transparency and determining data accuracy.
Track AI models from request to production.
Create a flow with a set of connectors and stages to transform and integrate data. Provide enriched and tailored information for your enterprise.
Create a virtual table to segment or combine data from one or more tables.
Measure outcomes from your AI models and help ensure the fairness, explainability, and compliance of all your models.
Replicate data to target systems with low latency, transactional integrity and optimized data capture.
Consolidate data from the disparate sources that fuel your business and establish a single, trusted, 360-degree view of your customers.
Services you can use
Services add features and tools to the platform.
Develop powerful AI solutions with an integrated collaborative studio and industry-standard APIs and SDKs. Formerly known as Watson Studio.
Quickly build, run and manage generative AI and machine learning applications with built-in performance and scalability. Formerly known as Watson Machine Learning.
Discover, profile, catalog, and share trusted data in your organization.
Create ETL and data pipeline services for real-time, micro-batch, and batch data orchestration.
View, access, manipulate, and analyze your data without moving it.
Monitor your AI models for bias, fairness, and trust with added transparency on how your AI models make decisions.
Provide efficient change data capture and near real-time data delivery with transactional integrity.
Improve trust in AI pipelines by identifying duplicate records and providing reliable data about your customers, suppliers, or partners.
Increase data pipeline transparency so you can determine data accuracy throughout your models and systems.
Where you'll work
Collaborative workspaces contain tools for specific tasks.
Where you work with data.
> Projects > View all projects
Where you find and share assets.
> Catalogs > View all catalogs
Where you deploy and run assets that are ready for testing or production.
> Deployments
Where you manage governance artifacts.
> Governance > Categories
Where you virtualize data.
> Data > Data virtualization
Where you consolidate data into a 360 degree view.