You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@drill.apache.org by br...@apache.org on 2018/04/05 01:05:39 UTC
drill git commit: edit spnego and impersonation docs
Repository: drill
Updated Branches:
refs/heads/gh-pages dd36343e8 -> f511ae086
edit spnego and impersonation docs
Project: http://git-wip-us.apache.org/repos/asf/drill/repo
Commit: http://git-wip-us.apache.org/repos/asf/drill/commit/f511ae08
Tree: http://git-wip-us.apache.org/repos/asf/drill/tree/f511ae08
Diff: http://git-wip-us.apache.org/repos/asf/drill/diff/f511ae08
Branch: refs/heads/gh-pages
Commit: f511ae08658de73432ec624ae620af5924a6df17
Parents: dd36343
Author: Bridget Bevens <bb...@maprtech.com>
Authored: Wed Apr 4 18:05:12 2018 -0700
Committer: Bridget Bevens <bb...@maprtech.com>
Committed: Wed Apr 4 18:05:12 2018 -0700
----------------------------------------------------------------------
.../040-configuring-user-impersonation.md | 14 +++++++-------
...ing-drill-to-use-spnego-for-http-authentication.md | 11 +++--------
2 files changed, 10 insertions(+), 15 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/drill/blob/f511ae08/_docs/configure-drill/securing-drill/040-configuring-user-impersonation.md
----------------------------------------------------------------------
diff --git a/_docs/configure-drill/securing-drill/040-configuring-user-impersonation.md b/_docs/configure-drill/securing-drill/040-configuring-user-impersonation.md
index 3a3ec6a..de839de 100644
--- a/_docs/configure-drill/securing-drill/040-configuring-user-impersonation.md
+++ b/_docs/configure-drill/securing-drill/040-configuring-user-impersonation.md
@@ -1,6 +1,6 @@
---
title: "Configuring User Impersonation"
-date: 2016-05-05 21:44:32 UTC
+date: 2018-04-05 01:05:13 UTC
parent: "Securing Drill"
---
Impersonation allows a service to act on behalf of a client while performing the action requested by the client. By default, user impersonation is disabled in Drill. You can configure user impersonation in the <DRILLINSTALL_HOME>/conf/drill-override.conf file.
@@ -18,13 +18,13 @@ When impersonation is enabled and user Bob issues a query through the SQLLine cl
## Impersonation Support
-The following table lists the clients, storage plugins, and types of queries that you can use with impersonation in Drill:
+The following table lists the clients, storage plugins, and types of queries that you can use with impersonation in Drill:
-| Type | Supported | Not Supported |
-|-----------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------|
-| Clients | SQLLine, ODBC, JDBC | Drill Web Console, REST API |
-| Storage Plugins | File System, Hive, MapR-DB | HBase |
-| Queries | When you enable impersonation, the setting applies to queries on data and metadata. For example, if you issue the SHOW SCHEMAS command, Drill impersonates the user logged into the client to access the requested metadata. If you issue a SELECT query on a workspace, Drill impersonates the user logged in to the client to access the requested data. Drill applies impersonation to queries issued using the following commands: SHOW SCHEMAS, SHOW DATABASES, SHOW TABLES, CTAS, SELECT, CREATE VIEW, DROP VIEW, SHOW FILES. To successfully run the CTAS and CREATE VIEW commands, a user must have write permissions on the directory where the table or view will exist. Running these commands creates artifacts on the file system. | |
+| Type | Supported | Not Supported |
+|-----------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|
+| Clients | SQLLine, ODBC, JDBC, REST API, Drill Web Console | |
+| Storage Plugins | File System, Hive, MapR-DB | HBase |
+| Queries | When you enable impersonation, the setting applies to queries on data and metadata. For example, if you issue the SHOW SCHEMAS command, Drill impersonates the user logged into the client to access the requested metadata. If you issue a SELECT query on a workspace, Drill impersonates the user logged in to the client to access the requested data. Drill applies impersonation to queries issued using the following commands: SHOW SCHEMAS, SHOW DATABASES, SHOW TABLES, CTAS, SELECT, CREATE VIEW, DROP VIEW, SHOW FILES. To successfully run the CTAS and CREATE VIEW commands, a user must have write permissions on the directory where the table or view will exist. Running these commands creates artifacts on the file system. | |
## Impersonation and Views
You can use views with impersonation to provide granular access to data and protect sensitive information. When you create a view, Drill stores the view definition in a file and suffixes the file with .drill.view. For example, if you create a view named myview, Drill creates a view file named myview.drill.view and saves it in the current workspace or the workspace specified, such as dfs.views.myview. See [CREATE VIEW]({{site.baseurl}}/docs/create-view) Command.
http://git-wip-us.apache.org/repos/asf/drill/blob/f511ae08/_docs/configure-drill/securing-drill/091-configuring-drill-to-use-spnego-for-http-authentication.md
----------------------------------------------------------------------
diff --git a/_docs/configure-drill/securing-drill/091-configuring-drill-to-use-spnego-for-http-authentication.md b/_docs/configure-drill/securing-drill/091-configuring-drill-to-use-spnego-for-http-authentication.md
index 4a09c31..18d6906 100644
--- a/_docs/configure-drill/securing-drill/091-configuring-drill-to-use-spnego-for-http-authentication.md
+++ b/_docs/configure-drill/securing-drill/091-configuring-drill-to-use-spnego-for-http-authentication.md
@@ -1,6 +1,6 @@
---
title: "Configuring Drill to use SPNEGO for HTTP Authentication"
-date: 2018-04-04 23:22:53 UTC
+date: 2018-04-05 01:05:13 UTC
parent: "Securing Drill"
---
@@ -77,14 +77,9 @@ To configure SPNEGO on the web server, complete the following steps:
}
}
-3-(Optional) Configure the mapping from a Kerberos principal to a user account used by Drill.
+3-(Optional) To configure the mapping from a Kerberos principal to a user account used by Drill, update the `drill.exec.security.auth.auth_to_local` property in the `drill-override.conf` file with custom rules, as described in [Mapping from Kerberos Principal to OS user account](https://hadoop.apache.org/docs/r2.7.2/hadoop-project-dist/hadoop-common/SecureMode.html#Mapping_from_Kerberos_principal_to_OS_user_account "Mapping from Kerberos Principal").
-
-- Drill uses a Hadoop Kerberos name and rules to transform the client Kerberos principal to the principal Drill uses internally as the client’s identity. By default, this mapping rule extracts the first portion from the provided principal. For example, if the principal format is `<Name1>/<Name2>@realm`, the default rule extracts only Name1 from the principal and stores Name1 as the client’s identity on server side. Drill uses the short name, for example Name1, as the user account known to Drill. This user account name is used to determine if the authenticated user has administrative privileges.
-- Administrators can configure custom rules by setting the `drill.exec.security.auth.auth_to_local` property in the `drill-override.conf` file.
-
-
-See [Mapping from Kerberos Principal to OS user account](https://hadoop.apache.org/docs/r2.7.2/hadoop-project-dist/hadoop-common/SecureMode.html#Mapping_from_Kerberos_principal_to_OS_user_account "Mapping from Kerberos Principal") in the [Hadoop in Secure Mode](https://hadoop.apache.org/docs/r2.7.2/hadoop-project-dist/hadoop-common/SecureMode.html "Secure Mode Hadoop") documentation for details about how the rule works.
+**Note:** Drill uses a Hadoop Kerberos name and rules to transform the client Kerberos principal to the principal Drill uses internally as the client’s identity. By default, this mapping rule extracts the first portion from the provided principal. For example, if the principal format is <Name1>/<Name2>@realm, the default rule extracts only Name1 from the principal and stores Name1 as the client’s identity on server side. Drill uses the short name, for example Name1, as the user account known to Drill. This user account name is used to determine if the authenticated user has administrative privileges.
##Configuring SPNEGO on the Client