將SPNEGO用于Web UI的Kerberos身份驗(yàn)證

將SPNEGO用于Web UI的Kerberos身份驗(yàn)證

通過使用 hbase-site.xml 中的 hbase.security.authentication.ui 屬性配置 SPNEGO，可以啟用對(duì) HBase Web UI 的 Kerberos 身份驗(yàn)證（Kerberos-authentication）。啟用此身份驗(yàn)證要求 HBase 也配置為對(duì) RPC 使用 Kerberos 身份驗(yàn)證（例如，hbase.security.authentication = kerberos）。

<property>
  <name>hbase.security.authentication.ui</name>
  <value>kerberos</value>
  <description>Controls what kind of authentication should be used for the HBase web UIs.</description>
</property>
<property>
  <name>hbase.security.authentication</name>
  <value>kerberos</value>
  <description>The Kerberos keytab file to use for SPNEGO authentication by the web server.</description>
</property>

存在許多用于為 Web 服務(wù)器配置 SPNEGO 身份驗(yàn)證的屬性：

<property>
  <name>hbase.security.authentication.spnego.kerberos.principal</name>
  <value>HTTP/_HOST@EXAMPLE.COM</value>
  <description>Required for SPNEGO, the Kerberos principal to use for SPNEGO authentication by the
  web server. The _HOST keyword will be automatically substituted with the node's
  hostname.</description>
</property>
<property>
  <name>hbase.security.authentication.spnego.kerberos.keytab</name>
  <value>/etc/security/keytabs/spnego.service.keytab</value>
  <description>Required for SPNEGO, the Kerberos keytab file to use for SPNEGO authentication by the
  web server.</description>
</property>
<property>
  <name>hbase.security.authentication.spnego.kerberos.name.rules</name>
  <value></value>
  <description>Optional, Hadoop-style `auth_to_local` rules which will be parsed and used in the
  handling of Kerberos principals</description>
</property>
<property>
  <name>hbase.security.authentication.signature.secret.file</name>
  <value></value>
  <description>Optional, a file whose contents will be used as a secret to sign the HTTP cookies
  as a part of the SPNEGO authentication handshake. If this is not provided, Java's `Random` library
  will be used for the secret.</description>
</property>