About pass-through authentication

Splunk Analytics for Hadoop reaches End of Life on January 31, 2025.

To search a virtual index, Splunk Analytics for Hadoop requests MapReduce jobs and accesses HDFS files. By default, Splunk Analytics for Hadoop does this as the Splunk Analytics for Hadoop superuser. Using pass-through authentication, however, you can control which Splunk Analytics for Hadoop users submit MapReduce jobs and access HDFS files. You can also specify which queue the MapReduce jobs should use.

About Splunk Analytics for Hadoop Superusers, Splunk Analytics for Hadoop users, and Hadoop users

A Splunk Analytics for Hadoop Superuser is one (or all) of the following:

• The user used to install the Splunk search head.
• The Kerberos keytab user for a provider.

Hadoop users are users which a Hadoop cluster lets:

• Submit MapReduce jobs.
• Access HDFS, assuming it uses the operating system users/groups for your nodes, as Hadoop generally does by default. (It may work differently if you configured your Hadoop cluster differently.)

How pass-through authentication works with your users

Pass-through authentication lets you make the Splunk Analytics for Hadoop Superuser a proxy for any number of configured Splunk Analytics for Hadoop users. This way, Splunk Analytics for Hadoop users can act as Hadoop users to own the associated jobs, tasks, and files in Hadoop (and you can limit access to files in HDFS.)

Splunk Analytics for Hadoop users can be created via Splunks native user functionality or LDAP. For more information about setting up users, see the following topics in the Securing Splunk Enterprise manual:

• Set up user authentication with LDAP
• Set up user authentication with Splunk's built in system

Ways you can use pass-through authentication

The following use cases describes common ways you might use pass-through authentication:

• One Splunk Enterprise for Hadoop user to one Hadoop user: For example, you can configure your Splunk Analytics for Hadoop user to act as a Hadoop user associated with a specific queue or data set. In this case you simply map your user to a specific user in Hadoop. For example, if the Splunk Analytics for Hadoop user name is "msantos", on the Hadoop cluster, the name is "mattsantos" and queue is "Products."

• Many Splunk Analytics for Hadoop user to one Hadoop Users: You might want multiple Splunk Analytics for Hadoop users to act as a Hadoop user. For example, all of the below Splunk Analytics for Hadoop users could run as the "Executive" user on Hadoop, and are assigned the queue "Products:"
  • jbartlett
  • lmcgarry
  • jlyman

• Splunk Analytics for Hadoop user(s) to same Hadoop user with different queues: You can also run Splunk Analytics for Hadoop users as the same Hadoop user, but assign them different queues. For example, users in the last example run as the "Executive" user on Hadoop, and are assigned the queue "Products". But are respectively assigned to the following queues:
  • jbartlett runs as user "Executive" and is assigned the queue "prod-admin."
  • lmcgarry runs as user "Executive" and is assigned the queue "prod-staff."
  • jlyman runs as user "Executive" and is assigned the queue "prod-staff."