Using Kerberos with Solr

Using Kerberos and curl

You can use Kerberos authentication with clients such as curl. To use curl, begin by acquiring valid Kerberos credentials and then run the desired command. For example, you might use commands similar to the following:

$ kinit -kt username.keytab username
$ curl --negotiate -u foo:bar http://solrserver:8983/solr/

Using solrctl

If you are using solrctl to manage your deployment in an environment that requires Kerberos authentication, you must have valid Kerberos credentials, which you can get using kinit. For more information on solrctl, see solrctl Reference

Configuring SolrJ Library Usage

If using applications that use the solrj library, begin by establishing a Java Authentication and Authorization Service (JAAS) configuration file.

Create a JAAS file:

• If you have already used kinit to get credentials, you can have the client use those credentials. In such a case, modify your jaas-client.conf file to appear as follows:

  Client {
   com.sun.security.auth.module.Krb5LoginModule required
   useKeyTab=false
   useTicketCache=true
   principal="user/fully.qualified.domain.name@<YOUR-REALM>";
   };

  where user/fully.qualified.domain.name@<YOUR-REALM> is replaced with your credentials.
• If you want the client application to authenticate using a keytab, modify jaas-client.conf as follows:

  Client {
   com.sun.security.auth.module.Krb5LoginModule required
   useKeyTab=true
   keyTab="/path/to/user.keytab"
   storeKey=true
   useTicketCache=false
   principal="user/fully.qualified.domain.name@EXAMPLE.COM";
  };

  Replace /path/to/user.keytab with the keytab file you want to use and user/fully.qualified.domain.name@EXAMPLE.COM with the principal in the keytab. If the principal omits the hostname, omit it in the jaas-client.conf file as well (for example, jdoe@EXAMPLE.COM).

Use the JAAS file to enable solutions:

• Command line solutions
  Set the property when invoking the program. For example, if you were using a jar, you might use:

  java -Djava.security.auth.login.config=/home/user/jaas-client.conf -jar app.jar

• Java applications
  Set the Java system property java.security.auth.login.config. For example, if the JAAS configuration file is located on the filesystem as /home/user/jaas-client.conf. The Java system property java.security.auth.login.config must be set to point to this file. Setting a Java system property can be done programmatically, for example using a call such as:

  System.setProperty("java.security.auth.login.config", "/home/user/jaas-client.conf");

• The MapReduceIndexerTool
  The MapReduceIndexerTool uses SolrJ to pass the JAAS configuration file. Using the MapReduceIndexerTool in a secure environment requires the use of the HADOOP_OPTS variable to specify the JAAS configuration file. For example, you might issue a command such as the following:

  HADOOP_OPTS="-Djava.security.auth.login.config=/home/user/jaas.conf" \
  hadoop jar MapReduceIndexerTool

• Configuring the hbase-indexer CLI

  Certain hbase-indexer CLI commands such as replication-status attempt to read ZooKeeper hosts owned by HBase. To successfully use these commands in Solr in a secure environment, specify a JAAS configuration file with the HBase principal in the HBASE_INDEXER_OPTS environment variable. For example, you might issue a command such as the following:

  HBASE_INDEXER_OPTS="-Djava.security.auth.login.config=/home/user/hbase-jaas.conf" \
  hbase-indexer replication-status

Configuring Flume Morphline Solr Sink Usage

Repeat this process on all Flume hosts:

1. If you have not created a keytab file, do so now at /etc/flume-ng/conf/flume.keytab. This file should contain the service principal flume/<fully.qualified.domain.name>@<YOUR-REALM>. See Flume Authentication for more information.
2. Create a JAAS configuration file for flume at /etc/flume-ng/conf/jaas-client.conf. The file should appear as follows:

   Client {
    com.sun.security.auth.module.Krb5LoginModule required
    useKeyTab=true
    useTicketCache=false
    keyTab="/etc/flume-ng/conf/flume.keytab"
    principal="flume/<fully.qualified.domain.name>@<YOUR-REALM>";
   };

3. Add the flume JAAS configuration to the JAVA_OPTS in /etc/flume-ng/conf/flume-env.sh. For example, you might change:

   JAVA_OPTS="-Xmx500m"

   to:

   JAVA_OPTS="-Xmx500m -Djava.security.auth.login.config=/etc/flume-ng/conf/jaas-client.conf"