Overview
KNIME Business Hub executes workflows that may try to access Kerberos-secured services such as Apache Hive™, Apache Impala™ and Apache Hadoop® HDFS™.
This guide describes how to configure KNIME Business Hub so that it can authenticate itself against Kerberos.
To configure Kerberos on KNIME Analytics Platform, please refer to the Kerberos User Guide.
Prerequisites
Setting up KNIME Business Hub for Kerberos authentication has the following prerequisites:
-
For Kerberos:
-
An existing Kerberos KDC such as MIT Kerberos or Microsoft ActiveDirectory
-
A service principal for KNIME Business Hub. The recommended format is
knimehub/<host>@<REALM>
, where:-
<host>
is the fully-qualified domain name of the machine where KNIME Business Hub runs, -
<REALM>
is the Kerberos realm.
-
-
A keytab file for the KNIME Business Hub service principal.
-
A Kerberos client configuration file (
krb5.conf
). Alternatively, can be created manually (see section Setting upkrb5.conf
).
-
-
For KNIME Business Hub:
-
An existing KNIME Business Hub instance.
-
An execution context that operates using a selected custom executor image. If you are working with executor version
= 4.7.2
, the execution context needs to be created by pointing to a specific Docker image in order to work with Kerberos. A specific Docker image is available with the following name:registry.hub.knime.com/knime/knime-full:4.7.2-rc-000146-1816590
If you are working with executor version> 4.7.2
you can create the execution context using the corresponding docker image for the version that you want to use. A list is available here.Follow the instructions in the KNIME Business Hub User Guide to create a new execution context and specify the above Docker image.
-
Setting up krb5.conf
The KNIME Business Hub execution context might need to read the krb5.conf
file during Kerberos
authentication. In that case, a valid krb5.conf
file needs to be obtained.
In case the location of the file is unknown or the file is not available,
please contact the local administrator.
Creating krb5.conf
file
Alternatively, a krb5.conf
file can be created manually. A minimal configuration
file could look like this:
[libdefaults] default_realm = MYCOMPANY.COM forwardable = true udp_preference_limit = 1 [realms] MYCOMPANY.COM = { kdc = kdc.mycompany.com admin_server = kdc.mycompany.com }
The above example declares that the Kerberos realm is called MYCOMPANY.COM
and that the hostname of the Kerberos KDC is kdc.mycompany.com
.
The forwardable
flag is a prerequisite for some KNIME nodes to make use of
Kerberos constrained delegation
when executed on KNIME Business Hub.
The udp_preference_limit
variable value set to 1 is to ensure that when sending a message to the KDC, the library will try using TCP over UDP connection.
Adjust the values contained in the krb5.conf
file as appropriate for the setup
in use. Depending on the specific setup, more configuration settings may be necessary.
The krb5.conf
format is fully described as part of the MIT Kerberos documentation.
KNIME preferences
KNIME Business Hub allows to distribute customization profiles,
which can be used to distribute Kerberos preferences (including the krb5.conf
)
to KNIME Business Hub executors and KNIME Analytics Platform clients.
It is recommended to create separate customization profiles for KNIME Business Hub executors and for KNIME Analytics Platform clients. |
To create a customization profile you need to first create an .epf
preferences file that will contain the Kerberos configuration preferences.
The table below contains all supported Kerberos configuration options.
|
This configuration only applies if |
This configuration only applies if |
This configuration only applies if |
|
This configuration only applies if |
This configuration only applies if |
This configuration is available only for KNIME Analytics Platform clients. |
|
|
For example, a recommended Kerberos configurations for KNIME Business Hub executors could look like the following:
/instance/org.knime.kerberos/org.knime.kerberos.conf=FILE /instance/org.knime.kerberos/org.knime.kerberos.conf.file=${profile:location}/krb5.conf /instance/org.knime.kerberos/org.knime.kerberos.authMethod=KEYTAB /instance/org.knime.kerberos/org.knime.kerberos.keytabFile=<PATH_TO_KEYTAB> /instance/org.knime.kerberos/org.knime.kerberos.keytabPrincipal=<PRINCIPAL_VALUE>
If krb5.conf is used, copy the krb5.conf file into the profile folder
so that it will be distributed to all KNIME Business Hub executors along with the
preferences file.
|
Replace <PATH_TO_KEYTAB> with the path to the keytab file and <PRINCIPAL_VALUE>
with the service principal. The keytab must not be stored in the profile folder,
but needs to be present on the KNIME Business Hub executor machine(s) so that the
preferences can reference it by local path.
|
Now, once you created the .epf
file you can create a .zip
file that contains the following files:
-
preferences.epf
— created in the step above. -
krb5.conf
— created in the previous section. -
knimehub.keytab
Then follow the instructions to upload a customization profile to your KNIME Business Hub instance.
For KNIME Business Hub executors
To apply the customization profile to a KNIME Hub execution context’s executor, follow the instructions in the Apply a customization profile to KNIME Hub executor section.
For KNIME Analytics Platform clients
To apply the customization profile to a KNIME Analytics Platform client, follow the instructions in the Apply a customization profile to KNIME Analytics Platform client section.
Export preferences from KNIME Analytics Platform
This section describes an alternative way to set up Kerberos preferences graphically, instead of writing the preferences lines manually. The Kerberos preferences can be configured graphically in the preferences page in KNIME Analytics Platform. After that the preferences can be exported and the relevant lines copied to the profile file.
-
Start KNIME Analytics Platform.
-
Set all Kerberos preferences via File → Preferences → KNIME → Kerberos and export the preferences via File → Export Preferences. Please refer to Kerberos User Guide for more information on the Kerberos preferences page.
-
Open the exported preferences file and copy all the lines starting with
/instance/org.knime.kerberos/
into the profile file. -
Please make sure that any paths set in the preferences are valid on the Hub instance:
-
If
krb5.conf
is used, thekrb5.conf
file needs to be added together with the.epf
file to the.zip
file that will be uploaded to the KNIME Business Hub. After that, change the path tokrb5.conf
as following:/instance/org.knime.kerberos/org.knime.kerberos.conf.file=${profile:location}/krb5.conf
-
If keytab is used, please make sure the path is accessible by KNIME Business Hub.
-