Hadoop Authorization

Showing results for 
Search instead for 
Do you mean 
Reply
Highlighted
Participant II
Posts: 3
Registered: ‎10-27-2017
#1 of 4 3,388
Accepted Solution

Hadoop Authorization

Hello Team,

 

We gone through the Hadoop security document of  Centrify and we wanted to know if it suits our needs.

we would really appreciate if you could help us with below questions.

 

1) can we control the HDFS file system and setup the ACL on user/Group using Centrify

2) can we setup a roles on hive,hdfs and impala using Centrify like Apache Sentry.

 

* Role ex: Only select access on hive database, RW access on HDFS directory.

 

 

 

Thanks

 

Centrify Contributor II
Posts: 15
Registered: ‎04-01-2016
#2 of 4 3,379

Re: Hadoop Authorization

Hello-

 

The document online is probably a bit dated. We have an updated version based on the latest Cloudera/Centrify versions if you'd like.

 

Per your questions:

 

1) Centrify provides a PAM (authentication) module for Active Directory. Select users and groups can be enumerated by the operating system and HDFS will take the values from the OS. Nothing really changes on the Hadoop side other than where the account originates from.

 

2) Centrify also includes a role-based authorization platform called DirectAuthorize. This allows you to create policy for least privielge command elevation at the OS level. Sentry or Ranger would still be used to create role-based access to application layer data though you'd now be able to utilize Active Directory groups enumerated through Centrify to grant access.

 

Hope that helps. If you have any more questions or would like to setup a call to discuss, just let us know.

 

-- Mike

 

Participant II
Posts: 3
Registered: ‎10-27-2017
#3 of 4 3,326

Re: Hadoop Authorization

Thanks Mike,

 

Very good explanation thanks a lot 

Participant II
Posts: 3
Registered: ‎10-27-2017
#4 of 4 3,303

Re: Hadoop Authorization

Hello Mike,

 

Just to confim Centrify can apply the role/policy on user which is applicable for OS level not on HDFS or hadoop services  level right.

 

 

Thanks