DataWorks:Manage third-party authentication files

Prerequisites

Before you begin, ensure that you have:

• A DataWorks workspace with access to Management Center

• A Kerberos keytab file (.keytab) and a Kerberos configuration file (krb5.conf)

• An exclusive resource group for Data Integration or a Serverless resource group

• A data source of type HBase, Hadoop Distributed File System (HDFS), or Hive

Limitations

• Kerberos authentication supports only CDH cluster 6.x versions. Authentication may fail for other versions or self-managed clusters that have not been tested with Kerberos.

• Kerberos authentication supports only HBase, HDFS, and Hive data sources.

• Kerberos authentication requires an exclusive resource group for Data Integration or a Serverless resource group.

Upload an authentication file

1. Go to the Data Sources page.

   1. Log on to the DataWorks console. In the top navigation bar, select the desired region. In the left-side navigation pane, choose More > Management Center.

   2. On the page that appears, select the desired workspace from the drop-down list and click Go to Management Center.

   3. In the left-side navigation pane of the SettingCenter page, click Data Sources.

2. Click the Authentication File Management tab.

3. In the upper-right corner, click Upload Authentication File. In the dialog box, click Upload File, select the target file, enter a File Description, and then click OK.

Repeat this step to upload both the keytab file and the krb5.conf file.

Reference an authentication file in a data source

After uploading the authentication files, reference them on the data source configuration page. The following example uses an HDFS data source. For other supported data sources, see Supported data sources.

For full instructions on adding a data source, see Configure a data source.

Configure the following Kerberos-specific parameters:

More operations

The Authentication File Management page also supports the following operations:

Appendix: How Kerberos authentication works

Kerberos is a network authentication protocol based on symmetric keys. Its main feature is single sign-on (SSO): a user authenticates once to obtain a Ticket-Granting Ticket (TGT), then uses that TGT to access multiple services without re-entering credentials.

Both clients and servers rely on a Key Distribution Center (KDC) for identity verification. For background on Kerberos, see Overview.

Kerberos authentication in DataWorks follows four stages:

1. Client requests a TGT. When a client (principal) accesses a Kerberos-enabled data source, it first requests a TGT from the KDC.

2. KDC issues the TGT. The KDC authenticates the client and, if successful, issues an encrypted TGT with a limited validity period.

3. Client requests service access. The client uses the TGT to request access to specific service resources from the server.

4. Server authenticates the client. The server verifies the client's credentials. If authentication succeeds, the client is granted access.

The keytab file stores the authentication credentials of the resource principal, including principals and their encrypted keys. The krb5.conf file stores the KDC server configuration. Both files must be uploaded to the Authentication File Management page and referenced in the data source configuration before Kerberos authentication can work.