Knox for combining CAS authentication for UI and Kerberos for backend

2020-12-01 Thread Tien Dat PHAN
Dear experts, We are recently starting to adopt Knox as the principle component for equipping our data processing cluster a complete security layer. In fact, the situation is, in our cluster, there are Apache components like Apache HBase, HDFS which play the role as our data processing backend.

Re: Knox for combining CAS authentication for UI and Kerberos for backend

2020-12-01 Thread larry mccay
Hi Tien - Apache Knox sounds like exactly what you need here. Let me explain a bit about how Knox fits into the Hadoop ecosystem. Apache Hadoop established an integration pattern that is used across the ecosystem of related projects called proxyuser or Trusted Proxy [1]. This is a pattern that al

Re: Knox for combining CAS authentication for UI and Kerberos for backend

2020-12-01 Thread larry mccay
Just realized that I left out your specific question about CAS. We have support for CAS authentication. For this you will want to look into using KnoxSSO [1] and replacing the default config in the knoxsso.xml topology to use Pac4j [2] with it configured for CAS. You can then proxy access to your v

Re: Knox for combining CAS authentication for UI and Kerberos for backend

2020-12-01 Thread larry mccay
ugh - forgot the references for you that time... 1. http://knox.apache.org/books/knox-1-4-0/user-guide.html#KnoxSSO+Setup+and+Configuration 2. http://knox.apache.org/books/knox-1-4-0/user-guide.html#Pac4j+Provider+-+CAS+/+OAuth+/+SAML+/+OpenID+Connect http://knox.apache.org/books/knox-1-4-0/us

Re: Knox for combining CAS authentication for UI and Kerberos for backend

2020-12-02 Thread Tien Dat PHAN
Many thanks, Larry, for such useful information. Best regards Tien Dat On 2020/12/01 22:55:47, larry mccay wrote: > ugh - forgot the references for you that time... > > 1. > http://knox.apache.org/books/knox-1-4-0/user-guide.html#KnoxSSO+Setup+and+Configuration > 2. > http://knox.apache.org/boo

Re: Knox for combining CAS authentication for UI and Kerberos for backend

2020-12-02 Thread larry mccay
Hi Tien Dat - My pleasure. Thanks for your interest in Apache Knox. In fact, you should consider subscribing to the Knox dev@ and/or user@ mailing lists. Since you are not subscribed, your email needs to be accepted by a moderator and may get lost. You can do so from the apache knox Mailing List