Chapter 12. Cloudera Hue

Hue is a web application that provides an end-user focused interface for a large number of the projects in the Hadoop ecosystem. When Hadoop is configured with Kerberos authentication, then Hue must be configured with Kerberos credentials to properly access Hadoop. Kerberos is enabled by setting the following parameters in the hue.ini file:

hue_principal

The Kerberos principal name for the Hue, including the fully qualified domain name of the Hue server

hue_keytab

The path to the Kerberos keytab file containing Hue’s service credentials

kinit_path

The path to the Kerberos kinit command (not needed if kinit is on the path)

reinit_frequency

The frequency in seconds for Hue to renew its Kerberos tickets

These settings should be placed under the [[kerberos]] subsection of the [desktop] top-level section in the hue.ini file. See Example 12-1 for a sample Hue kerberos configuration.

Example 12-1. Configuring Kerberos in Hue
[desktop]
[[kerberos]]
hue_principal=hue/hue.example.com@EXAMPLE.COM
hue_keytab=/etc/hue/conf/hue.keytab
reinit_frequency=3600

Hue has its own set of authentication backends and authenticates against Hadoop and other projects using Kerberos. In order to perform actions on behalf of other users, Hadoop must be configured to trust the Hue service. This is done by configuring Hadoop’s proxy user/user impersonation capabilities. This is controlled by setting the hosts Hue can run on and the groups of users that Hue can impersonate. ...

Get Hadoop Security now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial