diff --git a/hetu-docs/en/connector/elasticsearch.md b/hetu-docs/en/connector/elasticsearch.md index 170568e34..01ba83dd2 100644 --- a/hetu-docs/en/connector/elasticsearch.md +++ b/hetu-docs/en/connector/elasticsearch.md @@ -83,7 +83,7 @@ This property is optional; the default is 1m. ### `elasticsearch.security` -Allows setting password security to authenticate to Elasticsearch. +Set the authentication type to connect to Elasticsearch. For now, only support `PASSWORD`. ### `elasticsearch.auth.user` @@ -123,6 +123,14 @@ The key password for the trust store specified by elasticsearch.tls.truststore-p This property is optional. +Example: + +``` properties +elasticsearch.tls.enabled=true +elasticsearch.tls.keystore-path=/etc/elasticsearch/openLooKeng.jks +elasticsearch.tls.keystore-password=keystore_password +``` + Data Types -------- diff --git a/hetu-docs/en/connector/hive-security.md b/hetu-docs/en/connector/hive-security.md index ac899e5fb..fe7a46a74 100644 --- a/hetu-docs/en/connector/hive-security.md +++ b/hetu-docs/en/connector/hive-security.md @@ -78,6 +78,7 @@ In a Kerberized Hadoop cluster, openLooKeng connects to the Hive metastore Thrif | `hive.metastore.service.principal` | The Kerberos principal of the Hive metastore service. | | `hive.metastore.client.principal` | The Kerberos principal that openLooKeng will use when connecting to the Hive metastore service. | | `hive.metastore.client.keytab` | Hive metastore client keytab location. | +| `hive.metastore.krb5.conf.path` | The Kerberos configuration file location. | #### `hive.metastore.authentication.type` @@ -127,6 +128,11 @@ The path to the keytab file that contains a key for the principal specified by This property is optional; no default value. +#### `hive.metastore.krb5.conf.path` +The path of Kerberos configuration file. This file must be readable by the operating system user running openLooKeng. + +This property is optional; no default value. + #### Example configuration with `NONE` authentication ``` properties @@ -143,6 +149,7 @@ hive.metastore.thrift.impersonation.enabled=true hive.metastore.service.principal=hive/hive-metastore-host.example.com@EXAMPLE.COM hive.metastore.client.principal=openlk@EXAMPLE.COM hive.metastore.client.keytab=/etc/openlookeng/hive.keytab +hive.metastore.krb5.conf.path=/etc/openlookeng/krb5.conf ``` When the authentication type for the Hive metastore Thrift service is `KERBEROS`, openLooKeng will connect as the Kerberos principal specified by the property `hive.metastore.client.principal`. openLooKeng will authenticate this principal using the keytab specified by the `hive.metastore.client.keytab` property, and will verify that the identity of the metastore matches `hive.metastore.service.principal`. diff --git a/hetu-docs/en/connector/hive.md b/hetu-docs/en/connector/hive.md index efe5083fe..38d98e6ee 100644 --- a/hetu-docs/en/connector/hive.md +++ b/hetu-docs/en/connector/hive.md @@ -138,6 +138,7 @@ Please see the [Hive Security Configuration](./hive-security.md) section for a m | `hive.metastore.client.principal` | The Kerberos principal that openLooKeng will use when connecting to the Hive metastore service. | | `hive.metastore.client.keytab` | Hive metastore client keytab location. | | `hive.metastore.thrift.is-role-name-case-sensitive` | whether the role name to be Case-Sensitive or not, default value false. | +| `hive.metastore.krb5.conf.path` | The Kerberos configuration file location. | diff --git a/hetu-docs/zh/connector/elasticsearch.md b/hetu-docs/zh/connector/elasticsearch.md index 16e1ab1a1..a9be9709e 100644 --- a/hetu-docs/zh/connector/elasticsearch.md +++ b/hetu-docs/zh/connector/elasticsearch.md @@ -77,7 +77,7 @@ elasticsearch.default-schema-name=default ### `elasticsearch.security` -连接Elasticsearch启用密码认证。 +配置连接Elasticsearch的认证类型。目前仅支持`PASSWORD`。 ### `elasticsearch.auth.user` @@ -116,6 +116,14 @@ Elasticsearch连接器提供了额外安全选项支持开启了TLS的Elasticsea 此属性是可选的。 +示例： + +``` properties +elasticsearch.tls.enabled=true +elasticsearch.tls.keystore-path=/etc/elasticsearch/openLooKeng.jks +elasticsearch.tls.keystore-password=keystore_password +``` + Data Types -------- diff --git a/hetu-docs/zh/connector/hive-security.md b/hetu-docs/zh/connector/hive-security.md index cb1dab87d..0f0df55f8 100644 --- a/hetu-docs/zh/connector/hive-security.md +++ b/hetu-docs/zh/connector/hive-security.md @@ -69,6 +69,7 @@ Hive连接器对这些服务的访问是在属性文件中配置的，该文件 | `hive.metastore.service.principal`| Hive元存储服务的Kerberos主体。| | `hive.metastore.client.principal`| openLooKeng在连接到Hive元存储服务时将使用的Kerberos主体。| | `hive.metastore.client.keytab`| Hive元存储客户端keytab位置。| +| `hive.metastore.krb5.conf.path`| Kerberos配置文件位置。| #### `hive.metastore.authentication.type` @@ -110,6 +111,12 @@ keytab文件的路径，该文件包含由`hive.metastore.client.principal`指 此属性是可选的；无默认值。 +#### `hive.metastore.krb5.conf.path` + +Kerberos配置文件的路径。该文件必须可由运行openLooKeng的操作系统用户读取。 + +此属性是可选的；无默认值。 + #### `NONE`身份验证配置示例 ``` properties @@ -126,6 +133,7 @@ hive.metastore.thrift.impersonation.enabled=true hive.metastore.service.principal=hive/hive-metastore-host.example.com@EXAMPLE.COM hive.metastore.client.principal=openlk@EXAMPLE.COM hive.metastore.client.keytab=/etc/openlookeng/hive.keytab +hive.metastore.krb5.conf.path=/etc/openlookeng/krb5.conf ``` 当Hive元存储Thrift服务的身份验证类型为`KERBEROS`时，openLooKeng将作为属性`hive.metastore.client.principal`指定的Kerberos主体进行连接。openLooKeng将使用`hive.metastore.client.keytab`属性指定的keytab对主体进行身份验证，并将验证元存储的标识是否与`hive.metastore.service.principal`匹配。 diff --git a/hetu-docs/zh/connector/hive.md b/hetu-docs/zh/connector/hive.md index 4a6de8e70..aac9a8305 100644 --- a/hetu-docs/zh/connector/hive.md +++ b/hetu-docs/zh/connector/hive.md @@ -127,6 +127,7 @@ Hive连接器安全需要的属性在[Hive配置属性](./hive.md#hive配置属 | `hive.metastore.client.principal`| openLooKeng在连接到Hive元存储服务时将使用的Kerberos主体。| | `hive.metastore.client.keytab`| Hive元存储客户端keytab位置。| | `hive.metastore.thrift.is-role-name-case-sensitive`| 角色名是否区分大小写，默认值为false。| +| `hive.metastore.krb5.conf.path`| Kerberos配置文件位置。| ## AWS Glue目录配置属性