Hadoop, Kerberos dan OpenLDAP
sequenceDiagram
participant U as User (Kerberos)
participant K as KDC
participant N as NN (hdfs/<host>)
participant L as LDAP
participant A as ACL
U->>K: kinit user@REALM
K-->>U: TGT
U->>N: hdfs dfs -ls /dir
N->>K: Req service ticket
K-->>N: Service ticket
N->>L: Get user groups
L-->>N: Group list
N->>A: Check ACL
A-->>N: Allow/Deny
N-->>U: Output
https://hadoop.apache.org/docs/current/hadoop-project-dist/hadoop-common/SecureMode.html
| Komponen Hadoop | Contoh principal servis | Tujuan |
|---|---|---|
| HDFS NameNode | nn/_HOST@REALM | Autentikasi daemon NameNode kpd pengguna & servis lain. |
| HDFS Secondary NameNode | sn/_HOST@REALM | Autentikasi daemon Secondary NameNode kpd pengguna & servis lain. |
| HDFS DataNode | dn/_HOST@REALM | Autentikasi daemon DataNode kpd NameNode & pengguna. |
| YARN ResourceManager | rm/_HOST@REALM | Autentikasi ResourceManager kpd NodeManager & pengguna. |
| YARN NodeManager | nm/_HOST@REALM | Autentikasi NodeManager kpd ResourceManager. |
| MapReduce JobHistoryServer | jhs/_HOST@REALM | Autentikasi JobHistoryServer kpd pengguna. |
| HTTP/REST API (jika ada) | HTTP/_HOST@REALM | Autentikasi untuk antaramuka HTTP/HTTPS. |
Kali terakhir dikemaskini:
