Installing Knox on ODP

hadoop.proxyuser.knox.groups=*

hadoop.proxyuser.knox.hosts=*

curl -iku admin:admin-password "https://$(hostname -f):8443/gateway/default/webhdfs/v1/?op=LISTSTATUS"

<topology>

​

            <gateway>

​

                <provider>

                    <role>authentication</role>

                    <name>ShiroProvider</name>

                    <enabled>true</enabled>

                    <param>

                        <name>sessionTimeout</name>

                        <value>30</value>

                    </param>

                    <param>

                        <name>main.ldapRealm</name>

                        <value>org.apache.hadoop.gateway.shirorealm.KnoxLdapRealm</value>

                    </param>

                    <param>

                        <name>main.ldapRealm.userDnTemplate</name>

                        <value>uid={0},ou=people,dc=hadoop,dc=apache,dc=org</value>

                    </param>

                    <param>

                        <name>main.ldapRealm.contextFactory.url</name>

                        <value>ldap://{{knox_host_name}}:33389</value>

                    </param>

                    <param>

                        <name>main.ldapRealm.contextFactory.authenticationMechanism</name>

                        <value>simple</value>

                    </param>

                    <param>

                        <name>urls./**</name>

                        <value>authcBasic</value>

                    </param>

                </provider>

​

                <provider>

                    <role>identity-assertion</role>

                    <name>Default</name>

                    <enabled>true</enabled>

                </provider>

​

                <provider>

                    <role>authorization</role>

                    <name>XASecurePDPKnox</name>

                    <enabled>true</enabled>

                </provider>

​

            </gateway>

​

            <service>

                <role>NAMENODE</role>

                <url>{{namenode_address}}</url>

            </service>

​

            <service>

                <role>JOBTRACKER</role>

                <url>rpc://{{rm_host}}:{{jt_rpc_port}}</url>

            </service>

​

            <service>

                <role>WEBHDFS</role>

                {{webhdfs_service_urls}}

            </service>

​

            <service>

                <role>WEBHCAT</role>

                <url>http://{{webhcat_server_host}}:{{templeton_port}}/templeton</url>

            </service>

​

            <service>

                <role>OOZIE</role>

                <url>http://{{oozie_server_host}}:{{oozie_server_port}}/oozie</url>

            </service>

​

            <service>

                <role>OOZIEUI</role>

                <url>http://{{oozie_server_host}}:{{oozie_server_port}}/oozie/</url>

            </service>

​

​

            <service>

                <role>WEBHBASE</role>

                <url>http://{{hbase_master_host}}:{{hbase_master_port}}</url>

            </service>

​

            <service>

                <role>HIVE</role>

                <url>http://{{hive_server_host}}:{{hive_http_port}}/{{hive_http_path}}</url>

            </service>

​

            <service>

                <role>RESOURCEMANAGER</role>

                <url>http://{{rm_host}}:{{rm_port}}/ws</url>

            </service>

​

            <service>

                <role>DRUID-COORDINATOR-UI</role>

                {{druid_coordinator_urls}}

            </service>

​

            <service>

                <role>DRUID-COORDINATOR</role>

                {{druid_coordinator_urls}}

            </service>

​

            <service>

                <role>DRUID-OVERLORD-UI</role>

                {{druid_overlord_urls}}

            </service>

​

            <service>

                <role>DRUID-OVERLORD</role>

                {{druid_overlord_urls}}

            </service>

​

            <service>

                <role>DRUID-ROUTER</role>

                {{druid_router_urls}}

            </service>

​

            <service>

                <role>DRUID-BROKER</role>

                {{druid_broker_urls}}

            </service>

​

            <service>

                <role>ZEPPELINUI</role>

                {{zeppelin_ui_urls}}

            </service>

​

            <service>

                <role>ZEPPELINWS</role>

                {{zeppelin_ws_urls}}

            </service>

​

            <service>

                <role>YARNUI</role>

                <url>http://newreleaseub2.acceldata.ce:8088</url>

            </service>

​

            <service>

                <role>AMBARIUI</role>

                <url>http://newreleaseub1.acceldata.ce:8080</url>

            </service>

​

            <service>

                <role>AMBARIWS</role>

                <url>ws://newreleaseub1.acceldata.ce:8080</url>

            </service>

​

            <service>

                <role>RANGER</role>

                <url>http://newreleaseub1.acceldata.ce:6080</url>

            </service>

​

            <service>

                <role>RANGERUI</role>

                <url>http://newreleaseub1.acceldata.ce:6080</url>

            </service>

​

           <service>

                <role>HDFSUI</role>

               <version>2.7.0</version>

                <url>http://newreleaseub1.acceldata.ce:50070</url>

            </service>

​

           <service>

                <role>SOLR</role>

               <version>6.0.0</version>

                <url>http://newreleaseub1.acceldata.ce:8886/solr</url>

            </service>

​

​

        </topology>

^https?:\/\/(.+\.acceldata\.ce):[0-9]+\/?.*$

^https?:\/\/(.+\.ubuntu\.ce):[0-9]+\/?.*$

root@newreleaseub1:/var/log/knox# ambari-server setup-ldap --ldap-url=newreleaseub1.acceldata.ce:33389

Using python  /usr/bin/python

Currently 'no auth method' is configured, do you wish to use LDAP instead [y/n] (y)?

Enter Ambari Admin login: admin

Enter Ambari Admin password:

​

Fetching LDAP configuration from DB. No configuration.

Please select the type of LDAP you want to use [AD/IPA/Generic](Generic):

Primary LDAP Host (ldap.ambari.apache.org):

Primary LDAP Port (389):

Secondary LDAP Host <Optional>:

Secondary LDAP Port <Optional>:

Use SSL [true/false] (false):

User object class (posixUser): person

User ID attribute (uid): uid

Group object class (posixGroup): groupofnames

Group name attribute (cn): cn

Group member attribute (memberUid): member

Distinguished name attribute (dn):

Search Base (dc=ambari,dc=apache,dc=org): dc=hadoop,dc=apache,dc=org

Referral method [follow/ignore] (follow):

Bind anonymously [true/false] (false):

Bind DN (uid=ldapbind,cn=users,dc=ambari,dc=apache,dc=org): uid=admin,ou=people,dc=hadoop,dc=apache,dc=org

Enter Bind DN Password:

Confirm Bind DN Password:

Handling behavior for username collisions [convert/skip] for LDAP sync (skip): convert

Force lower-case user names [true/false]:true

Results from LDAP are paginated when requested [true/false]:true

====================

Review Settings

====================

Primary LDAP Host (ldap.ambari.apache.org):  newreleaseub1.acceldata.ce

Primary LDAP Port (389):  33389

Use SSL [true/false] (false):  false

User object class (posixUser):  person

User ID attribute (uid):  uid

Group object class (posixGroup):  groupofnames

Group name attribute (cn):  cn

Group member attribute (memberUid):  member

Distinguished name attribute (dn):  dn

Search Base (dc=ambari,dc=apache,dc=org):  dc=hadoop,dc=apache,dc=org

Referral method [follow/ignore] (follow):  follow

Bind anonymously [true/false] (false):  false

Handling behavior for username collisions [convert/skip] for LDAP sync (skip):  convert

Force lower-case user names [true/false]: true

Results from LDAP are paginated when requested [true/false]: true

ambari.ldap.connectivity.bind_dn: uid=admin,ou=people,dc=hadoop,dc=apache,dc=org

ambari.ldap.connectivity.bind_password: *****

Save settings [y/n] (y)? y

Saving LDAP properties...

Saving LDAP properties finished

Ambari Server 'setup-ldap' completed successfully.

root@newreleaseub1:/var/log/knox# ambari-server sync-ldap --all

Using python  /usr/bin/python

Syncing with LDAP...

Enter Ambari Admin login: admin

Enter Ambari Admin password:

​

Fetching LDAP configuration from DB.

Syncing all...

​

Completed LDAP Sync.

Summary:

  memberships:

    removed = 0

    created = 4

  users:

    skipped = 0

    removed = 0

    updated = 1

    created = 3

  groups:

    updated = 0

    removed = 0

    created = 3

​

Ambari Server 'sync-ldap' completed successfully.

<topology>

  <gateway>

    <provider>

      <role>webappsec</role>

      <name>WebAppSec</name>

      <enabled>true</enabled>

      <param>

        <name>xframe.options.enabled</name>

        <value>true</value>

      </param>

    </provider>

    <provider>

      <role>authentication</role>

      <name>ShiroProvider</name>

      <enabled>true</enabled>

      <param>

        <name>sessionTimeout</name>

        <value>30</value>

      </param>

      <param>

        <name>redirectToUrl</name>

        <value>/gateway/knoxsso/knoxauth/login.html</value>

      </param>

      <param>

        <name>restrictedCookies</name>

        <value>rememberme,WWW-Authenticate</value>

      </param>

      <param>

        <name>main.ldapRealm</name>

        <value>org.apache.hadoop.gateway.shirorealm.KnoxLdapRealm</value>

      </param>

      <param>

        <name>main.ldapContextFactory</name>

        <value>org.apache.hadoop.gateway.shirorealm.KnoxLdapContextFactory</value>

      </param>

      <param>

        <name>main.ldapRealm.contextFactory</name>

        <value>$ldapContextFactory</value>

      </param>

      <param>

        <name>main.ldapRealm.userDnTemplate</name>

        <value>uid={0},ou=people,dc=hadoop,dc=apache,dc=org</value>

      </param>

      <param>

        <name>main.ldapRealm.contextFactory.url</name>

        <value>ldap://localhost:33389</value>

      </param>

      <param>

        <name>main.ldapRealm.authenticationCachingEnabled</name>

        <value>false</value>

      </param>

      <param>

        <name>main.ldapRealm.contextFactory.authenticationMechanism</name>

        <value>simple</value>

      </param>

      <param>

        <name>urls./**</name>

        <value>authcBasic</value>

      </param>

    </provider>

    <provider>

      <role>identity-assertion</role>

      <name>Default</name>

      <enabled>true</enabled>

    </provider>

  </gateway>

  <application>

    <name>knoxauth</name>

  </application>

  <service>

    <role>KNOXSSO</role>

    <param>

      <name>knoxsso.cookie.secure.only</name>

      <value>false</value>

    </param>

    <param>

      <name>knoxsso.token.ttl</name>

      <value>30000</value>

    </param>

    <param>

      <name>knoxsso.cookie.samesite</name>

      <value>Lax</value>

    </param>

  </service>

</topology>

<topology>

    <gateway>

        <provider>

            <role>federation</role>

            <name>SSOCookieProvider</name>

            <enabled>true</enabled>

            <param>

                <name>sso.authentication.provider.url</name>

                <value>https://<hostname>:8443/gateway/knoxsso/api/v1/websso</value>

            </param>

        </provider>

        <provider>

            <role>identity-assertion</role>

            <name>Default</name>

            <enabled>true</enabled>

        </provider>

      </gateway>

    <service>

        <role>AMBARI</role>

        <url>http://<hostname>:8080</url>

    </service>

    <service>

        <role>AMBARIUI</role>

        <url>http://<hostname>:8080</url>

    </service>

    <service>

        <role>HDFSUI</role>

        <url>http://<hostname>:50070</url>

        <param>

            <name>retryCount</name>

            <value>1</value>

        </param>

    </service>

    <service>

        <role>NAMENODE</role>

        <url>hdfs://ODP-Chronos</url>

    </service>

    <service>

        <role>WEBHDFS</role>

        <url>http://<hostname>:50070/webhdfs</url>

    </service>

    <service>

        <role>RANGER</role>

        <url>http://<hostname>:6080</url>

    </service>

    <service>

        <role>RANGERUI</role>

        <url>http://<hostname>:6080</url>

    </service>

    <service>

        <role>RESOURCEMANAGER</role>

        <url>http://<hostname>:8088/ws</url>

    </service>

    <service>

        <role>YARNUI</role>

        <url>http://<hostname>:8088</url>

    </service>

</topology>

oozie.service.ProxyUserService.proxyuser.knox.groups=*

oozie.service.ProxyUserService.proxyuser.knox.hosts=*

https://newreleaseub1.acceldata.ce:8443/gateway/default/oozie/

http://newreleaseub1.acceldata.ce:11000/oozie/?user.name=admin

http://newreleaseub1.acceldata.ce:50070/dfshealth.html #tab-overview

https://newreleaseub1.acceldata.ce:8443/gateway/default/hdfs/dfshealth.html #tab-overview

http://newreleaseub1.acceldata.ce:8088/ui2/#/cluster-overview

https://newreleaseub1.acceldata.ce:8443/gateway/default/yarn

<param>

    <name>knoxsso.cookie.samesite</name>

    <value>Lax</value>

</param>

root@odp03:~# ambari-server setup-sso

Using python  /usr/bin/python

Setting up SSO authentication properties...

Enter Ambari Admin login: admin

Enter Ambari Admin password:

​

SSO is currently enabled

Do you want to disable SSO authentication [y/n] (n)? y

Ambari Server 'setup-sso' completed successfully.

hadoop.http.authentication.public.key.pem

hadoop.http.authentication.authentication.provider.url

hadoop.http.authentication.type=org.apache.hadoop.security.authentication.server.JWTRedirectAuthenticationHandler

proxyuser.knox.groups

proxyuser.knox.hosts

proxyuser.knox.groups

proxyuser.knox.hosts

proxyuser.knox.ip

proxyuser.knox.users

SSO public key

SSO provider URL

Enable Ranger SSO - Set to False

oozie.authentication.type

oozie.authentication.expected.jwt.audiences

oozie.authentication.jwt.cookie