You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@drill.apache.org by br...@apache.org on 2017/08/07 19:29:38 UTC
[09/10] drill-site git commit: Drill 1.11 Encryption and Security
Content from Catherine Skrbina/Drill 1.11 Identifier Quotes Content from
Bridget Bevens
http://git-wip-us.apache.org/repos/asf/drill-site/blob/e1cf1a3e/docs/case/index.html
----------------------------------------------------------------------
diff --git a/docs/case/index.html b/docs/case/index.html
index 3864102..19aa209 100644
--- a/docs/case/index.html
+++ b/docs/case/index.html
@@ -292,11 +292,11 @@
<li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-impersonation-with-hive-authorization/">Configuring User Impersonation with Hive Authorization</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-authentication/">Configuring User Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-security/">Configuring User Security</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-plain-authentication/">Configuring Plain Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-plain-security/">Configuring Plain Security</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-kerberos-authentication/">Configuring Kerberos Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-kerberos-security/">Configuring Kerberos Security</a></li>
<li class="toctree-l3"><a class="reference internal" href="/docs/configuring-web-console-and-rest-api-security/">Configuring Web Console and REST API Security</a></li>
http://git-wip-us.apache.org/repos/asf/drill-site/blob/e1cf1a3e/docs/choosing-a-storage-format/index.html
----------------------------------------------------------------------
diff --git a/docs/choosing-a-storage-format/index.html b/docs/choosing-a-storage-format/index.html
index 805db9e..aaa4261 100644
--- a/docs/choosing-a-storage-format/index.html
+++ b/docs/choosing-a-storage-format/index.html
@@ -292,11 +292,11 @@
<li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-impersonation-with-hive-authorization/">Configuring User Impersonation with Hive Authorization</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-authentication/">Configuring User Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-security/">Configuring User Security</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-plain-authentication/">Configuring Plain Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-plain-security/">Configuring Plain Security</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-kerberos-authentication/">Configuring Kerberos Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-kerberos-security/">Configuring Kerberos Security</a></li>
<li class="toctree-l3"><a class="reference internal" href="/docs/configuring-web-console-and-rest-api-security/">Configuring Web Console and REST API Security</a></li>
http://git-wip-us.apache.org/repos/asf/drill-site/blob/e1cf1a3e/docs/compiling-drill-from-source/index.html
----------------------------------------------------------------------
diff --git a/docs/compiling-drill-from-source/index.html b/docs/compiling-drill-from-source/index.html
index 38b3b9b..9320fdd 100644
--- a/docs/compiling-drill-from-source/index.html
+++ b/docs/compiling-drill-from-source/index.html
@@ -292,11 +292,11 @@
<li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-impersonation-with-hive-authorization/">Configuring User Impersonation with Hive Authorization</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-authentication/">Configuring User Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-security/">Configuring User Security</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-plain-authentication/">Configuring Plain Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-plain-security/">Configuring Plain Security</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-kerberos-authentication/">Configuring Kerberos Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-kerberos-security/">Configuring Kerberos Security</a></li>
<li class="toctree-l3"><a class="reference internal" href="/docs/configuring-web-console-and-rest-api-security/">Configuring Web Console and REST API Security</a></li>
http://git-wip-us.apache.org/repos/asf/drill-site/blob/e1cf1a3e/docs/configuration-options-introduction/index.html
----------------------------------------------------------------------
diff --git a/docs/configuration-options-introduction/index.html b/docs/configuration-options-introduction/index.html
index 9eb8f9a..267c4a2 100644
--- a/docs/configuration-options-introduction/index.html
+++ b/docs/configuration-options-introduction/index.html
@@ -292,11 +292,11 @@
<li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-impersonation-with-hive-authorization/">Configuring User Impersonation with Hive Authorization</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-authentication/">Configuring User Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-security/">Configuring User Security</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-plain-authentication/">Configuring Plain Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-plain-security/">Configuring Plain Security</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-kerberos-authentication/">Configuring Kerberos Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-kerberos-security/">Configuring Kerberos Security</a></li>
<li class="toctree-l3"><a class="reference internal" href="/docs/configuring-web-console-and-rest-api-security/">Configuring Web Console and REST API Security</a></li>
@@ -1126,7 +1126,7 @@
</div>
- Apr 6, 2017
+ Aug 7, 2017
<link href="/css/docpage.css" rel="stylesheet" type="text/css">
@@ -1322,7 +1322,7 @@
<tr>
<td>planner.enable_hashjoin</td>
<td>TRUE</td>
-<td>Enable the memory hungry hash join. Drill assumes that a query with have adequate memory to complete and tries to use the fastest operations possible to complete the planned inner, left, right, or full outer joins using a hash table. Does not write to disk. Disabling hash join allows Drill to manage arbitrarily large data in a small memory footprint.</td>
+<td>Enable the memory hungry hash join. Drill assumes that a query will have adequate memory to complete and tries to use the fastest operations possible to complete the planned inner, left, right, or full outer joins using a hash table. Does not write to disk. Disabling hash join allows Drill to manage arbitrarily large data in a small memory footprint.</td>
</tr>
<tr>
<td>planner.enable_hashjoin_swap</td>
http://git-wip-us.apache.org/repos/asf/drill-site/blob/e1cf1a3e/docs/configuration-options/index.html
----------------------------------------------------------------------
diff --git a/docs/configuration-options/index.html b/docs/configuration-options/index.html
index 242870e..0d9244c 100644
--- a/docs/configuration-options/index.html
+++ b/docs/configuration-options/index.html
@@ -292,11 +292,11 @@
<li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-impersonation-with-hive-authorization/">Configuring User Impersonation with Hive Authorization</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-authentication/">Configuring User Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-security/">Configuring User Security</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-plain-authentication/">Configuring Plain Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-plain-security/">Configuring Plain Security</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-kerberos-authentication/">Configuring Kerberos Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-kerberos-security/">Configuring Kerberos Security</a></li>
<li class="toctree-l3"><a class="reference internal" href="/docs/configuring-web-console-and-rest-api-security/">Configuring Web Console and REST API Security</a></li>
http://git-wip-us.apache.org/repos/asf/drill-site/blob/e1cf1a3e/docs/configure-drill-introduction/index.html
----------------------------------------------------------------------
diff --git a/docs/configure-drill-introduction/index.html b/docs/configure-drill-introduction/index.html
index 4658246..337d7b5 100644
--- a/docs/configure-drill-introduction/index.html
+++ b/docs/configure-drill-introduction/index.html
@@ -292,11 +292,11 @@
<li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-impersonation-with-hive-authorization/">Configuring User Impersonation with Hive Authorization</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-authentication/">Configuring User Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-security/">Configuring User Security</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-plain-authentication/">Configuring Plain Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-plain-security/">Configuring Plain Security</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-kerberos-authentication/">Configuring Kerberos Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-kerberos-security/">Configuring Kerberos Security</a></li>
<li class="toctree-l3"><a class="reference internal" href="/docs/configuring-web-console-and-rest-api-security/">Configuring Web Console and REST API Security</a></li>
http://git-wip-us.apache.org/repos/asf/drill-site/blob/e1cf1a3e/docs/configure-drill/index.html
----------------------------------------------------------------------
diff --git a/docs/configure-drill/index.html b/docs/configure-drill/index.html
index 499de2b..c36a1ff 100644
--- a/docs/configure-drill/index.html
+++ b/docs/configure-drill/index.html
@@ -292,11 +292,11 @@
<li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-impersonation-with-hive-authorization/">Configuring User Impersonation with Hive Authorization</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-authentication/">Configuring User Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-security/">Configuring User Security</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-plain-authentication/">Configuring Plain Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-plain-security/">Configuring Plain Security</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-kerberos-authentication/">Configuring Kerberos Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-kerberos-security/">Configuring Kerberos Security</a></li>
<li class="toctree-l3"><a class="reference internal" href="/docs/configuring-web-console-and-rest-api-security/">Configuring Web Console and REST API Security</a></li>
@@ -1152,11 +1152,11 @@
<li><a href="/docs/configuring-user-impersonation-with-hive-authorization/">Configuring User Impersonation with Hive Authorization</a></li>
- <li><a href="/docs/configuring-user-authentication/">Configuring User Authentication</a></li>
+ <li><a href="/docs/configuring-user-security/">Configuring User Security</a></li>
- <li><a href="/docs/configuring-plain-authentication/">Configuring Plain Authentication</a></li>
+ <li><a href="/docs/configuring-plain-security/">Configuring Plain Security</a></li>
- <li><a href="/docs/configuring-kerberos-authentication/">Configuring Kerberos Authentication</a></li>
+ <li><a href="/docs/configuring-kerberos-security/">Configuring Kerberos Security</a></li>
<li><a href="/docs/configuring-web-console-and-rest-api-security/">Configuring Web Console and REST API Security</a></li>
http://git-wip-us.apache.org/repos/asf/drill-site/blob/e1cf1a3e/docs/configuring-a-multitenant-cluster-introduction/index.html
----------------------------------------------------------------------
diff --git a/docs/configuring-a-multitenant-cluster-introduction/index.html b/docs/configuring-a-multitenant-cluster-introduction/index.html
index 1d913c9..3cc64e6 100644
--- a/docs/configuring-a-multitenant-cluster-introduction/index.html
+++ b/docs/configuring-a-multitenant-cluster-introduction/index.html
@@ -292,11 +292,11 @@
<li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-impersonation-with-hive-authorization/">Configuring User Impersonation with Hive Authorization</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-authentication/">Configuring User Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-security/">Configuring User Security</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-plain-authentication/">Configuring Plain Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-plain-security/">Configuring Plain Security</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-kerberos-authentication/">Configuring Kerberos Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-kerberos-security/">Configuring Kerberos Security</a></li>
<li class="toctree-l3"><a class="reference internal" href="/docs/configuring-web-console-and-rest-api-security/">Configuring Web Console and REST API Security</a></li>
http://git-wip-us.apache.org/repos/asf/drill-site/blob/e1cf1a3e/docs/configuring-a-multitenant-cluster/index.html
----------------------------------------------------------------------
diff --git a/docs/configuring-a-multitenant-cluster/index.html b/docs/configuring-a-multitenant-cluster/index.html
index 82687b3..e97a814 100644
--- a/docs/configuring-a-multitenant-cluster/index.html
+++ b/docs/configuring-a-multitenant-cluster/index.html
@@ -292,11 +292,11 @@
<li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-impersonation-with-hive-authorization/">Configuring User Impersonation with Hive Authorization</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-authentication/">Configuring User Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-security/">Configuring User Security</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-plain-authentication/">Configuring Plain Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-plain-security/">Configuring Plain Security</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-kerberos-authentication/">Configuring Kerberos Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-kerberos-security/">Configuring Kerberos Security</a></li>
<li class="toctree-l3"><a class="reference internal" href="/docs/configuring-web-console-and-rest-api-security/">Configuring Web Console and REST API Security</a></li>
http://git-wip-us.apache.org/repos/asf/drill-site/blob/e1cf1a3e/docs/configuring-drill-memory/index.html
----------------------------------------------------------------------
diff --git a/docs/configuring-drill-memory/index.html b/docs/configuring-drill-memory/index.html
index f0b4841..792e88e 100644
--- a/docs/configuring-drill-memory/index.html
+++ b/docs/configuring-drill-memory/index.html
@@ -292,11 +292,11 @@
<li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-impersonation-with-hive-authorization/">Configuring User Impersonation with Hive Authorization</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-authentication/">Configuring User Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-security/">Configuring User Security</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-plain-authentication/">Configuring Plain Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-plain-security/">Configuring Plain Security</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-kerberos-authentication/">Configuring Kerberos Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-kerberos-security/">Configuring Kerberos Security</a></li>
<li class="toctree-l3"><a class="reference internal" href="/docs/configuring-web-console-and-rest-api-security/">Configuring Web Console and REST API Security</a></li>
http://git-wip-us.apache.org/repos/asf/drill-site/blob/e1cf1a3e/docs/configuring-inbound-impersonation/index.html
----------------------------------------------------------------------
diff --git a/docs/configuring-inbound-impersonation/index.html b/docs/configuring-inbound-impersonation/index.html
index 371435b..b23f2f3 100644
--- a/docs/configuring-inbound-impersonation/index.html
+++ b/docs/configuring-inbound-impersonation/index.html
@@ -292,11 +292,11 @@
<li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-impersonation-with-hive-authorization/">Configuring User Impersonation with Hive Authorization</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-authentication/">Configuring User Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-security/">Configuring User Security</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-plain-authentication/">Configuring Plain Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-plain-security/">Configuring Plain Security</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-kerberos-authentication/">Configuring Kerberos Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-kerberos-security/">Configuring Kerberos Security</a></li>
<li class="toctree-l3"><a class="reference internal" href="/docs/configuring-web-console-and-rest-api-security/">Configuring Web Console and REST API Security</a></li>
@@ -1126,7 +1126,7 @@
</div>
- Jul 27, 2017
+ Aug 7, 2017
<link href="/css/docpage.css" rel="stylesheet" type="text/css">
@@ -1134,7 +1134,7 @@
<p>Drill supports <a href="/docs/configuring-user-impersonation/">user impersonation</a> where queries run as the user that created a connection. However, this user is not necessarily the end user who submits the queries. For example, in a classic three-tier architecture, the end user interacts with Tableau Desktop, which communicates with a Tableau Server, which in turn communicates with a Drill cluster. In this scenario, a proxy user creates a connection, and the queries are submitted to Drill by the proxy user on behalf of the end user, and not by the end user directly. In this particular case, the query needs to be run as the end user. </p>
-<p>As of Drill 1.6, an administrator can define inbound impersonation policies to impersonate the end user. The proxy user needs to be authorized to submit queries on behalf of the specified end user. Otherwise, any user can impersonate another user. Then, the query runs as the end user, and data authorization is based on this user’s access permissions. Note that without <a href="/docs/configuring-user-authentication/">authentication</a> enabled in both communication channels, a user can impersonate any other user.</p>
+<p>As of Drill 1.6, an administrator can define inbound impersonation policies to impersonate the end user. The proxy user needs to be authorized to submit queries on behalf of the specified end user. Otherwise, any user can impersonate another user. Then, the query runs as the end user, and data authorization is based on this user’s access permissions. Note that without <a href="/docs/configuring-user-security/">authentication</a> enabled in both communication channels, a user can impersonate any other user.</p>
<p>Drill trusts proxy users to provide the correct end user identity information. Drill does not authenticate the end user. The proxy user (application) is responsible for end user authentication, which is usually enabled.</p>
@@ -1176,27 +1176,13 @@
target_principals: { users : [“...”, “...”], groups : [“...”, “...”] } }
</code></pre></div></li>
</ul></li>
-<li><p>Ensure that the proxy user (application) passes the username of the impersonation target user to Drill when creating a connection. </p></li>
-</ol>
-
-<p>The following examples show you how to do this for JDBC and ODBC: </p>
-
-<ul>
-<li><p>For JDBC, through SQLLine using the <code>impersonation_target</code> connection property:</p>
-<div class="highlight"><pre><code class="language-text" data-lang="text"> bin/sqlline –u “jdbc:drill:schema=dfs;zk=myclusterzk;impersonation_target=euser1” -n puser1 -p ppass1
+<li><p>Ensure that the proxy user (application) passes the username of the impersonation target user to Drill when creating a connection through the <code>impersonation_target</code> connection property. For example, through sqlline: </p>
+<div class="highlight"><pre><code class="language-text" data-lang="text">bin/sqlline –u “jdbc:drill:schema=dfs;zk=myclusterzk;impersonation_target=euser1” -n puser1 -p ppass1
</code></pre></div></li>
-</ul>
+</ol>
<p>In this example, <code>puser1</code> is the user submitting the queries. This user is authenticated. Since this user is authorized to impersonate any user, queries through the established connection are run as <code>euser1</code>.</p>
-<ul>
-<li><p>For ODBC on Linux or Mac, you can pass the username through the <code>DelegationUID</code> property in the odbc.ini file. See <a href="/docs/configuring-odbc-on-linux/">Configuring ODBC on Linux</a> for more information. </p>
-<div class="highlight"><pre><code class="language-text" data-lang="text"> DelegationUID=euser1
-</code></pre></div></li>
-</ul>
-
-<p>If you are using ODBC on Windows, you can use the <strong>ODBC Data Source Administrator</strong> to provide the username through the <code>Delegation UID</code> field in the MapR Drill ODBC Driver DSN Setup dialog box. See <a href="/docs/configuring-odbc-on-windows/">Configuring ODBC on Windows</a> for more information.</p>
-
<div class="doc-nav">
http://git-wip-us.apache.org/repos/asf/drill-site/blob/e1cf1a3e/docs/configuring-jreport-with-drill/index.html
----------------------------------------------------------------------
diff --git a/docs/configuring-jreport-with-drill/index.html b/docs/configuring-jreport-with-drill/index.html
index 0bafee3..f367191 100644
--- a/docs/configuring-jreport-with-drill/index.html
+++ b/docs/configuring-jreport-with-drill/index.html
@@ -292,11 +292,11 @@
<li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-impersonation-with-hive-authorization/">Configuring User Impersonation with Hive Authorization</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-authentication/">Configuring User Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-user-security/">Configuring User Security</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-plain-authentication/">Configuring Plain Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-plain-security/">Configuring Plain Security</a></li>
- <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-kerberos-authentication/">Configuring Kerberos Authentication</a></li>
+ <li class="toctree-l3"><a class="reference internal" href="/docs/configuring-kerberos-security/">Configuring Kerberos Security</a></li>
<li class="toctree-l3"><a class="reference internal" href="/docs/configuring-web-console-and-rest-api-security/">Configuring Web Console and REST API Security</a></li>