You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@hbase.apache.org by kumar r <ku...@gmail.com> on 2016/11/02 07:28:16 UTC
HBase rest custom authentication
I want to enable custom authentication for HBase rest server in a normal
cluster (not secured)
I have implemented custom authentication class by implementing Hadoop
Authentication Handler
I have set the property
<property>
<name>hbase.rest.authentication.type</name>
<value>custom.class.name</value>
</property>
But still it didn't ask for any authentication. When i access hbase rest
url, it directly displays table names
http://machine1:8080/
Do i need to set any other property?
or Custom authentication works only on kerberos enabled cluster?
Please clarify and help me to achieve this.
Thanks,
Re: HBase rest custom authentication
Posted by kumar r <ku...@gmail.com>.
Thank you for your reply.
@Ted actually i am implementing Authentication Handler to secure HBase Rest
service gateway. I don't have any idea to secure HBase thrift server with
authentication. I don't want to enable security for HBase services but i
want to secure HBase rest service alone. How can i do that?
@Jerry So do you mean that Custom AuthFilter should be implemented to
achieve this? Seems there is no update in Jira since 2014.
Thanks
On Wed, Nov 2, 2016 at 11:29 PM, Jerry He <je...@gmail.com> wrote:
> The reason your custom authentication does not work is probably due
> to HBASE-12231. It does not get invoked.
>
> The code snippet that Ted copied is inside "if keberos security". The
> AuthFilter
> itself can handle custom authentication class. But AuthFilter is not added
> in your case.
>
> Jerry
>
>
>
> On Wed, Nov 2, 2016 at 7:14 AM, Ted Yu <yu...@gmail.com> wrote:
>
> > From RESTServer.java :
> >
> > if (conf.get(REST_AUTHENTICATION_TYPE) != null) {
> > containerClass = RESTServletContainer.class;
> > FilterHolder authFilter = new FilterHolder();
> > authFilter.setClassName(AuthFilter.class.getName());
> > authFilter.setName("AuthenticationFilter");
> > return new Pair<FilterHolder, Class<? extends
> > ServletContainer>>(authFilter,containerClass);
> >
> > So hbase.rest.authentication.type doesn't accept class name.
> >
> > Can you tell us more about your Authentication Handler implementation ?
> >
> > Thanks
> >
> > On Wed, Nov 2, 2016 at 12:28 AM, kumar r <ku...@gmail.com> wrote:
> >
> > > I want to enable custom authentication for HBase rest server in a
> normal
> > > cluster (not secured)
> > >
> > > I have implemented custom authentication class by implementing Hadoop
> > > Authentication Handler
> > >
> > > I have set the property
> > >
> > > <property>
> > > <name>hbase.rest.authentication.type</name>
> > > <value>custom.class.name</value>
> > > </property>
> > >
> > > But still it didn't ask for any authentication. When i access hbase
> rest
> > > url, it directly displays table names
> > >
> > > http://machine1:8080/
> > >
> > > Do i need to set any other property?
> > >
> > > or Custom authentication works only on kerberos enabled cluster?
> > >
> > > Please clarify and help me to achieve this.
> > >
> > > Thanks,
> > >
> >
>
Re: HBase rest custom authentication
Posted by Jerry He <je...@gmail.com>.
The reason your custom authentication does not work is probably due
to HBASE-12231. It does not get invoked.
The code snippet that Ted copied is inside "if keberos security". The
AuthFilter
itself can handle custom authentication class. But AuthFilter is not added
in your case.
Jerry
On Wed, Nov 2, 2016 at 7:14 AM, Ted Yu <yu...@gmail.com> wrote:
> From RESTServer.java :
>
> if (conf.get(REST_AUTHENTICATION_TYPE) != null) {
> containerClass = RESTServletContainer.class;
> FilterHolder authFilter = new FilterHolder();
> authFilter.setClassName(AuthFilter.class.getName());
> authFilter.setName("AuthenticationFilter");
> return new Pair<FilterHolder, Class<? extends
> ServletContainer>>(authFilter,containerClass);
>
> So hbase.rest.authentication.type doesn't accept class name.
>
> Can you tell us more about your Authentication Handler implementation ?
>
> Thanks
>
> On Wed, Nov 2, 2016 at 12:28 AM, kumar r <ku...@gmail.com> wrote:
>
> > I want to enable custom authentication for HBase rest server in a normal
> > cluster (not secured)
> >
> > I have implemented custom authentication class by implementing Hadoop
> > Authentication Handler
> >
> > I have set the property
> >
> > <property>
> > <name>hbase.rest.authentication.type</name>
> > <value>custom.class.name</value>
> > </property>
> >
> > But still it didn't ask for any authentication. When i access hbase rest
> > url, it directly displays table names
> >
> > http://machine1:8080/
> >
> > Do i need to set any other property?
> >
> > or Custom authentication works only on kerberos enabled cluster?
> >
> > Please clarify and help me to achieve this.
> >
> > Thanks,
> >
>
Re: HBase rest custom authentication
Posted by Ted Yu <yu...@gmail.com>.
From RESTServer.java :
if (conf.get(REST_AUTHENTICATION_TYPE) != null) {
containerClass = RESTServletContainer.class;
FilterHolder authFilter = new FilterHolder();
authFilter.setClassName(AuthFilter.class.getName());
authFilter.setName("AuthenticationFilter");
return new Pair<FilterHolder, Class<? extends
ServletContainer>>(authFilter,containerClass);
So hbase.rest.authentication.type doesn't accept class name.
Can you tell us more about your Authentication Handler implementation ?
Thanks
On Wed, Nov 2, 2016 at 12:28 AM, kumar r <ku...@gmail.com> wrote:
> I want to enable custom authentication for HBase rest server in a normal
> cluster (not secured)
>
> I have implemented custom authentication class by implementing Hadoop
> Authentication Handler
>
> I have set the property
>
> <property>
> <name>hbase.rest.authentication.type</name>
> <value>custom.class.name</value>
> </property>
>
> But still it didn't ask for any authentication. When i access hbase rest
> url, it directly displays table names
>
> http://machine1:8080/
>
> Do i need to set any other property?
>
> or Custom authentication works only on kerberos enabled cluster?
>
> Please clarify and help me to achieve this.
>
> Thanks,
>