{"action":"created","issue":{"url":"https://api.github.com/repos/facebook/presto/issues/3380","labels_url":"https://api.github.com/repos/facebook/presto/issues/3380/labels{/name}","comments_url":"https://api.github.com/repos/facebook/presto/issues/3380/comments","events_url":"https://api.github.com/repos/facebook/presto/issues/3380/events","html_url":"https://github.com/facebook/presto/issues/3380","id":98102124,"number":3380,"title":"kerberos authentification","user":{"login":"chey-jp","id":13566339,"avatar_url":"https://avatars.githubusercontent.com/u/13566339?v=3","gravatar_id":"","url":"https://api.github.com/users/chey-jp","html_url":"https://github.com/chey-jp","followers_url":"https://api.github.com/users/chey-jp/followers","following_url":"https://api.github.com/users/chey-jp/following{/other_user}","gists_url":"https://api.github.com/users/chey-jp/gists{/gist_id}","starred_url":"https://api.github.com/users/chey-jp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chey-jp/subscriptions","organizations_url":"https://api.github.com/users/chey-jp/orgs","repos_url":"https://api.github.com/users/chey-jp/repos","events_url":"https://api.github.com/users/chey-jp/events{/privacy}","received_events_url":"https://api.github.com/users/chey-jp/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-07-30T07:25:11Z","updated_at":"2015-08-18T21:16:23Z","closed_at":null,"body":"We are trying to use presto with hadoop and hive, using kerberos authenticaion. \r\nThere are several options, but we are unclear as to what they are currently controlling\r\n\r\n[for example]\r\n+ presto_cli has these options:\r\n--krb5-config-path, --krb5-keytab-path, --krb5-principal\r\n\r\n+ ${presto_dir}/etc/jvm.config:\r\n-Dhttp.authentication.krb5.config=/${krb5.conf.dir}\r\n-Dhttp.authentication.krb5.credential-cache=/tmp\r\n-Dhttp.authentication.krb5.keytab=${keytabfiledir}\r\n\r\nWhen we look at the logs from the kerberos server, we do not see any request from presto. (Currently we are using a single presto node).\r\n\r\nCurrently, does Presto support kerberos authentication when using hadoop?\r\nIf it does, is there any example I can refer to?\r\nIf it doesn't, is there any plans in the near future to implement it?"},"comment":{"url":"https://api.github.com/repos/facebook/presto/issues/comments/132354313","html_url":"https://github.com/facebook/presto/issues/3380#issuecomment-132354313","issue_url":"https://api.github.com/repos/facebook/presto/issues/3380","id":132354313,"user":{"login":"JeffSaxe","id":13858558,"avatar_url":"https://avatars.githubusercontent.com/u/13858558?v=3","gravatar_id":"","url":"https://api.github.com/users/JeffSaxe","html_url":"https://github.com/JeffSaxe","followers_url":"https://api.github.com/users/JeffSaxe/followers","following_url":"https://api.github.com/users/JeffSaxe/following{/other_user}","gists_url":"https://api.github.com/users/JeffSaxe/gists{/gist_id}","starred_url":"https://api.github.com/users/JeffSaxe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JeffSaxe/subscriptions","organizations_url":"https://api.github.com/users/JeffSaxe/orgs","repos_url":"https://api.github.com/users/JeffSaxe/repos","events_url":"https://api.github.com/users/JeffSaxe/events{/privacy}","received_events_url":"https://api.github.com/users/JeffSaxe/received_events","type":"User","site_admin":false},"created_at":"2015-08-18T21:16:23Z","updated_at":"2015-08-18T21:16:23Z","body":"Thank you for all your work on Presto; initial tests on our small cluster show it to be not too painful to deploy, and very, very fast.   :-)   Our production Hadoop clusters have mandatory Kerberos turned on, through, so I'm glad to see this issue logged and with nearly 500 other people watching it.\r\n\r\nEven though full Kerberos support isn't quite ready, can we (today, in version 0.114) do a tech preview / testing version of it, by configuring the last part of your email without the first? I.e., can we configure a static \"superuser\" credential, in the form of a principal name and keytab, that Presto Server can use to read the table files from HDFS, while ignoring authentication from the Presto client to the server? Obviously that is a gaping security weakness, but if we're willing to work in that state for a while, will it work now? If so, very briefly how do I configure it? Thanks."}}