Hadoop HTTP 웹 콘솔 인증
Hadoop HTTP 웹 콘솔 인증
이 문서는 Hadoop HTTP 웹 콘솔이 사용자 인증을 요구하도록 구성하는 방법을 설명합니다.
기본적으로 Hadoop HTTP 웹 콘솔(ResourceManager, NameNode, NodeManager, DataNode)은 어떤 형태의 인증 없이도 접근을 허용합니다.
Hadoop HTTP 웹 콘솔은 HTTP SPNEGO 프로토콜(Firefox, Internet Explorer 같은 브라우저가 지원)을 사용해 Kerberos 인증을 요구하도록 구성할 수 있습니다.
추가로 Hadoop HTTP 웹 콘솔은 Hadoop의 Pseudo/Simple 인증에 해당하는 기능을 지원합니다. 이 옵션을 활성화하면 첫 브라우저 상호작용에서 user.name 쿼리 문자열 파라미터를 사용해 사용자 이름을 지정해야 합니다. 예: http://localhost:8088/cluster?user.name=babu.
HTTP 웹 콘솔에 사용자 지정 인증 메커니즘이 필요하면 대체 인증 메커니즘을 지원하는 플러그인을 구현할 수 있습니다(AuthenticationHandler 작성 방법은 Hadoop hadoop-auth 참고).
설정 (Configuration)
다음 속성은 클러스터의 모든 노드 core-site.xml에 있어야 합니다.
| Property Name | Default Value | Description | | --- || --- || --- | | hadoop.http.filter.initializers | | Add to this property the org.apache.hadoop.security.AuthenticationFilterInitializer initializer class. | | hadoop.http.authentication.type | simple | Defines authentication used for the HTTP web-consoles. The supported values are: simple | kerberos | #AUTHENTICATION_HANDLER_CLASSNAME#. | | hadoop.http.authentication.token.validity | 36000 | Indicates how long (in seconds) an authentication token is valid before it has to be renewed. | | hadoop.http.authentication.token.max-inactive-interval | -1 (disabled) | Specifies the time, in seconds, between client requests the server will invalidate the token. | | hadoop.http.authentication.signature.secret.file | $user.home/hadoop-http-auth-signature-secret | The signature secret file for signing the authentication tokens. A different secret should be used for each service in the cluster, ResourceManager, NameNode, DataNode and NodeManager. This file should be readable only by the Unix user running the daemons. | | hadoop.http.authentication.cookie.domain | | The domain to use for the HTTP cookie that stores the authentication token. For authentication to work correctly across all nodes in the cluster the domain must be correctly set. There is no default value, the HTTP cookie will not have a domain working only with the hostname issuing the HTTP cookie. | | hadoop.http.authentication.cookie.persistent | false (session cookie) | Specifies the persistence of the HTTP cookie. If the value is true, the cookie is a persistent one. Otherwise, it is a session cookie. IMPORTANT: when using IP addresses, browsers ignore cookies with domain settings. For this setting to work properly all nodes in the cluster must be configured to generate URLs with hostname.domain names on it. | | hadoop.http.authentication.simple.anonymous.allowed | true | Indicates whether anonymous requests are allowed when using ‘simple’ authentication. | | hadoop.http.authentication.kerberos.principal | HTTP/_HOST@$LOCALHOST | Indicates the Kerberos principal to be used for HTTP endpoint when using ‘kerberos’ authentication. The principal short name must be HTTP per Kerberos HTTP SPNEGO specification. _HOST -if present- is replaced with bind address of the HTTP server. | | hadoop.http.authentication.kerberos.keytab | $user.home/hadoop.keytab | Location of the keytab file with the credentials for the Kerberos principal used for the HTTP endpoint. |
CORS
교차 출처 지원(CORS)을 활성화하려면 다음 설정 파라미터를 설정하세요.
core-site.xml의 hadoop.http.filter.initializers에 org.apache.hadoop.security.HttpCrossOriginFilterInitializer를 추가하세요. 또한 core-site.xml에 다음 속성을 설정해야 합니다.
| Property | Default Value | Description | | --- || --- || --- | | hadoop.http.cross-origin.enabled | false | Enables cross origin support for all web-services | | hadoop.http.cross-origin.allowed-origins | * | Comma separated list of origins that are allowed. Values prefixed with regex: are interpreted as regular expressions. Values containing wildcards (*) are possible as well, here a regular expression is generated, the use is discouraged and support is only available for backward compatibility. | | hadoop.http.cross-origin.allowed-methods | GET,POST,HEAD | Comma separated list of methods that are allowed | | hadoop.http.cross-origin.allowed-headers | X-Requested-With,Content-Type,Accept,Origin | Comma separated list of headers that are allowed | | hadoop.http.cross-origin.max-age | 1800 | Number of seconds a pre-flighted request can be cached |
신뢰 프록시 (Trusted Proxy)
Trusted Proxy는 프록시 사용자 대신 **최종 사용자(end user)**로 작업을 수행하는 것을 지원합니다. doAs 쿼리 파라미터에서 최종 사용자를 가져옵니다. Trusted Proxy를 활성화하려면 다음 설정 파라미터를 설정하세요.
core-site.xml에서 org.apache.hadoop.security.AuthenticationFilterInitializer 대신 org.apache.hadoop.security.authentication.server.ProxyUserAuthenticationFilterInitializer를 hadoop.http.filter.initializers에 추가하세요.