Set Up Kerberos for Pentaho

Last updated
Save as PDF

How you set up Kerberos on a machine that the Pentaho Server can access to connect to Big Data clusters depends on your operating system.

Configure Kerberos on Linux

To configure Linux computers, complete these tasks.

Configure JCE

The KDC configuration uses an “unlimited” AES-256 encryption setting by default for the Java Cryptographic Extension (JCE) files. However, the import and export control rules about cryptographic software vary by country. If you must change this encryption to remain in compliance, then you can adjust the strength by updating the security property.

NoteYou may need to consult your export/import control counsel to determine the exact cryptographic policy for your location.

Perform the following steps if you must configure JCE:

Procedure

Open the pentaho/java/conf/security/java.security file in any text editor.
Locate the # Cryptographic Jurisdiction Policy defaults section and set the crypto.policy as shown:
crypto.policy=limited
Save the file and close the text editor.

Modify the Kerberos configuration file

Perform the following steps to modify your Kerberos configuration file:

Procedure

Open the krb5.conf file with any text editor.
The default location is the /etc directory.

Add your realm, KDC, and Admin Server information as shown in the following example:

[libdefaults]
       default_realm = <YOUR_REALM.COM>
...

[realms]
<YOUR_REALM.COM>= {
kdc=<KDC IP Address, or resolvable Hostname>
admin_server=<Admin Server IP Address, or resolvable Hostname>
...
}
[domain_realm]
<.your_realm.com> = <YOUR_REALM.COM>
<your_realm.com> = <YOUR_REALM.COM>

Save and close the configuration file.
Restart the computer.

Synchronize clocks

Synchronize the clock on the Linux client with the clock on the Hadoop cluster. If the timestamp on the client requests differs too much from the clock on the cluster, Kerberos will not authenticate the user. Consult your operating system's documentation for information on setting your systems clock.

Obtain Kerberos ticket

To obtain a Kerberos ticket, complete these steps.

Procedure

Open a Terminal window and type kinit at the prompt.
Enter a password when prompted.
Make sure that the Kerberos ticket was granted by typing klist at the prompt.
The authentication information appears.

Next step

Go to the Set Up User Accounts and Ensure Network Access section.

Configure Kerberos for Windows

To configure Kerberos on Windows computers, complete these tasks.

Configure JCE

NoteYou may need to consult your export/import control counsel to determine the exact cryptographic policy for your location.

Perform the following steps if you must configure JCE:

Procedure

Open the pentaho\java\conf\security\java.security file in any text editor.
Locate the # Cryptographic Jurisdiction Policy defaults section and set the crypto.policy as shown:
crypto.policy=limited
Save the file and close the text editor.

Download and install Kerberos

Download and install a Kerberos server. We recommend that you use the Heimdal implementation of Kerberos, which can be found here: https://www.secure-endpoints.com/heimdal/.

Modify the Kerberos configuration file

Perform the following steps to modify your Kerberos configuration file:

Procedure

Open the krb5.conf file with any text editor. The default location is the C:\ProgramData\Kerberos directory.

Add your realm, KDC, and Admin Server information as shown in the following example:

[libdefaults]
       default_realm = <YOUR_REALM.COM>
...

[realms]
<YOUR_REALM.COM>= {
kdc=<KDC IP Address, or resolvable Hostname>
admin_server=<Admin Server IP Address, or resolvable Hostname>
...
}
[domain_realm]
<.your_realm.com> = <YOUR_REALM.COM>
<your_realm.com> = <YOUR_REALM.COM>

Save and close the configuration file.
Make a copy of the configuration file and place it in the c:\Windows directory. Rename the file krb5.ini.
Restart the computer.

Synchronize clocks

Synchronize the clock on the Windows client with the clock on the Hadoop cluster. If the timestamp on the client requests differs too much from the clock on the cluster, Kerberos will not authenticate the user. Consult your operating system's documentation for information on setting your systems clock. The times on the Windows clock and the Hadoop cluster clock must not be greater than the range you entered for the clockskew variable in krb5.conf file. Consult your operating system's documentation for information on setting your systems clock.

Obtain Kerberos ticket

To obtain a Kerberos ticket, complete these steps.

Procedure

Open a Command Prompt window and type kinit at the prompt.
Enter a password when prompted.
Make sure that the Kerberos ticket was granted by typing klist at the prompt.
The authentication information appears.
NoteIf you are using the Heimdal version of Kerberos, the klist command output should not have the Current LoginId is ... prompt.

Set up user accounts and network access for all OS

Ensure that user accounts and network access has been granted. Specific tasks include:

Ensure the ports you plan to use are open between the cluster and computers running Pentaho components, like the Pentaho Server, Spoon, PRD, and PME.
Make sure each server can use a hostname to access each computer on the cluster. Test to ensure that IP addresses resolve to hostnames using both forward and reverse lookups.
Add user account credentials for each Pentaho user needing access to the cluster through the Kerberos database.
Make sure the UID and GID for the user that you are running your jobs as on the matches the user UID and GID of that user for every computer of the cluster.

Next step

Continue with the configuration process: