Эх сурвалжийг харах

HUE-9345 [knox] how to configure hue to use knoxspnegodjango backend on secure cluster

weixia 5 жил өмнө
parent
commit
b82defbdb1

+ 108 - 0
docs/gethue/content/en/posts/2020-05-05-how-to-configure-hue-to-use-knoxspnegodjango-backend-on-secure-cluster.md

@@ -0,0 +1,108 @@
+---
+title: How to Configure Hue to authenticate with Apache Knox SSO on a Secure Cluster
+author: Weixia Xu
+type: post
+date: 2020-05-05T00:00:00+00:00
+url: /blog/how-to-configure-hue-to-use-knoxspnegodjango-backend/
+sf_thumbnail_type:
+  - none
+sf_thumbnail_link_type:
+  - link_to_post
+sf_detail_type:
+  - none
+sf_page_title:
+  - 1
+sf_page_title_style:
+  - standard
+sf_no_breadcrumbs:
+  - 1
+sf_page_title_bg:
+  - none
+sf_page_title_text_style:
+  - light
+sf_background_image_size:
+  - cover
+sf_social_sharing:
+  - 1
+sf_related_articles:
+  - 1
+sf_sidebar_config:
+  - left-sidebar
+sf_left_sidebar:
+  - Sidebar-2
+sf_right_sidebar:
+  - Sidebar-1
+sf_caption_position:
+  - caption-right
+ampforwp-amp-on-off:
+  - default
+categories:
+  - Administration
+  - Version 4.8
+
+---
+Hello, Hue administrators,
+
+The [Apache Knox™ Gateway](https://knox.apache.org/) is an Application Gateway for interacting with the REST APIs
+ and UIs of Apache Hadoop deployments.
+
+Hue supports KnoxSpnegoDjango since Hue4.6, we can turn on Hue’s KnoxSpnegoDjango auth by updating Hue configurations
+ through CM UI or hue.ini.
+
+On any cluster with Knox service installed, update hue.ini as following and restart Hue:
+    [desktop]
+    [[auth]]
+    backend=desktop.auth.backend.KnoxSpnegoDjangoBackend
+    [[knox]]
+    knox_principal=knox
+    knox_proxyhosts=weixia-1.domain.site,weixia-2.domain.site
+
+Or on any CM managed cluster, Hue can be configured with KnoxSpnegoDjango backend through CM UI:
+![hue-auth-knoxspnego.png](https://cdn.gethue.com/uploads/2020/05/hue-auth-knoxspnego.png)
+
+Fill knox_proxyhosts field with accurate knox proxy hostname, you can get the hosts by navigating to Clusters->KNOX, and
+click on 'Instances' tab:
+![knox-ha-hosts.png](https://cdn.gethue.com/uploads/2020/05/knox-ha-hosts.png)
+For Knox HA cluster, you can fill in all the hosts by clicking on "+" icon:
+![configure-hue-with-knox-ha.png](https://cdn.gethue.com/uploads/2020/05/configure-hue-with-knox-ha.png)
+
+Click 'Save Changes', you will see a warning about role missing kerberos keytab. Click on “Administration”-->”Security” as shown below:
+![role-missing-kerberos-keytab.png](https://cdn.gethue.com/uploads/2020/05/role-missing-kerberos-keytab.png)
+![generate-missing-credentials.png](https://cdn.gethue.com/uploads/2020/05/generate-missing-credentials.png)
+Then navigate back to Clusters->HUE-1, click on the "stale configuration: Restart" icon beside the "Actions" button,
+![stale-configuration-restart.png](https://cdn.gethue.com/uploads/2020/05/stale-configuration-restart.png)
+follow the wizard to choose "Restart staled services", select "Re-deploy client configuration" and click on "Restart Now",
+wait till it finishes.
+
+Navigate to Hue’s Web UI dropdown and select “Knox Gateway UI” to load Knox UI:
+![knox-gateway-ui.png](https://cdn.gethue.com/uploads/2020/05/knox-gateway-ui.png)
+Then click on “+” icon of “+cdp-proxy” to expand:
+![knox-gateway-ui-cdp-proxy.png](https://cdn.gethue.com/uploads/2020/05/knox-gateway-ui-cdp-proxy.png)
+
+Now click on the Hue icon:
+![knox-proxy-login-hue-icon.png](https://cdn.gethue.com/uploads/2020/05/knox-proxy-login-hue-icon.png)
+
+You should be able to log in to hue page:
+
+![hue-page.png](https://cdn.gethue.com/uploads/2020/05/hue-page.png)
+
+
+## Troubleshooting
+1. If you hit error like "The username or password you entered is incorrect."
+![incorrect-user-or-password.png](https://cdn.gethue.com/uploads/2020/05/incorrect-user-or-password.png)
+Check on your knox proxy hosts that user or password is correct.
+    ssh root@weixia-1.domain.site
+    useradd weixia
+    passwd weixia
+
+2. If you hit 403 error:
+![hue-login-403.png](https://cdn.gethue.com/uploads/2020/05/hue-login-403.png)
+
+Log in to your ranger service and ensure your user or group say 'public' has proper permissions.
+
+![ranger-cm-knox-policies.png](https://cdn.gethue.com/uploads/2020/05/ranger-cm-knox-policies.png)
+
+Any feedback or questions? Feel free to comment here or on the [Forum](https://discourse.gethue.com/) or
+[@gethue](https://twitter.com/gethue) and [quick start](https://docs.gethue.com/quickstart/) SQL querying!
+
+Weixia Xu from the Hue Team