Configure pass-through authentication in the configuration file

Splunk Analytics for Hadoop reaches End of Life on January 31, 2025.

This topic describes how to edit indexes.conf and impersonation.conf so that Splunk Analytics for Hadoop users are able to act as Hadoop users. This lets you to give specific Splunk Analytics for Hadoop users the ability to submit MapReduce jobs as different Hadoop users to a specific queue. To configure pass-through authentication using the Splunk Web user interface, see Map pass-through authentication.

With pass-through authentication, Splunk Enterprise for Hadoop uses its Superuser as a proxy to Hadoop, letting you interact with Hadoop. You can configure this to be a Hadoop user with the same name as the Superuser, or a user with different name.

To learn more about how pass-through authentication works, see About pass-through authentication.

Configure Hadoop Cluster to support pass-through authentication

Once you enable pass-through authentication, interactions with Hadoop happen as the Hadoop user with the same name as the Splunk Analytics for Hadoop user who is logged in. Hadoop must be configured as follows to support this:

1. Make sure that any Hadoop user you want Splunk Analytics for Hadoop users to act as exists on each Hadoop node. You can manually create them or use LDAP to create them.

2. Ensure your Superuser is in the Hadoop Supergroup. You can find the Hadoop supergroup in the hdfs-site.xml file as dfs.permissions.supergroup.

If your Superuser is not in the Supergroup on each Hadoop node, use the following command to add the Superuser to the Supergroup on each node:

sudo usermod -G <group name> <user name>. 

3. Create home directories in HDFS for the users in your Hadoop clusters, and ensure that provider's Hadoop home vix.splunk.home.hdfs in HDFS is readable and executable by all the users added in step 2.

4. Add a stanza to core-site.xml to allow the Hadoop user (with the same name as the Splunk Analytics for Hadoop Superuser) to act as a proxy for Hadoop users in designated node user groups:

Note: For best results, we recommend you do this against Kerberized clusters. For more information about using Kerberos, see Configure Kerberos Authentication.

<property>
<name>hadoop.proxyuser.<name of your Splunk Analytics for Hadoop Superuser>.groups</name>
<value>group1,group2</value>
<description>Allows the Splunk Analytics for Hadoop Superuser to impersonate any
members of the group group1 and group2</description>
</property>

5. Optionally limit connections by host:

<property>
<name>hadoop.proxyuser.<name of your Splunk Analytics for Hadoop Superuser>.hosts</name>
<value>host1,host2</value>
<description>The superuser can connect only from host1 and
host2 to impersonate a user</description>
</property>

Configure pass-through authentication in Splunk Analytics for Hadoop

In the next steps, you can configure Splunk Analytics for Hadoop users to submit jobs to a specific queue and/or interact with Hadoop as a Hadoop user with a different name than the Splunk Analytics for Hadoop user logged in.

1. Turn on the feature in indexes.conf for each provider:

[provider:myprovider]
vix.splunk.impersonation = 1

2. Optionally map Splunk Analytics for Hadoop users to a specific alias and queue in HDFS by updating impersonation.conf:

[provider:myprovider]
admin = {"user": "hadoopadmin"}
splunkanalyticsforhadoopuser1 = {"queue": "red"}

[provider:mycdh]
splunkanalyticsforhadoopuser1 = {"user": "hadoopuser", "queue": "blue"}