JanusGraph support for Kerberized Solr

[sarath...@gmail.com]

I have my application (Apache Atlas) using JanusGraph (0.2.0) with HBase as storage and Solr cloud as indexing backend. Both HBase and Solr have been secured using Kerberos. 

I see a solr exception when I fire an index query from gremlin shell - "401: Authentication required"

Does JanusGraph support kerberos authenticated Solr ? What are are the steps needed to enable this? I did not find any kerberos related configuration for JanusGraph in the documentation. 

Thanks,

Sarath

[marc.de...@gmail.com]

Hi Sarath,

Are you using JanusGraph in embbed mode or via gremlin-server?  In the latter case, do you already have a keytab for the HBase access? The keytab also needs a credential for SOLR access. The solr client used by gremlin-server might need a JAAS config file.

First resources I looked at (funnily including a Cloudera one :-) ):

https://github.com/JanusGraph/janusgraph/blob/master/janusgraph-solr/src/main/java/org/janusgraph/diskstorage/solr/SolrIndex.java

https://www.cloudera.com/documentation/enterprise/5-9-x/topics/search_using_kerberos.html

Cheers, Marc  (hdp user)

Op woensdag 20 december 2017 08:05:36 UTC+1 schreef Sarath Kumar:

[sarath...@gmail.com]

Marc,

I'm using JanusGraph in embedded mode. I was able to get around this issue by adding few lines in SolrIndex.java.

From the Solr documentation, its mentioned to add the below lines, before we create SolrClient.  I updated SolrIndex to add the lines and janusgraph was able to authenticate with Solr.

System.setProperty("java.security.auth.login.config", "/home/foo/jaas-client.conf");
HttpClientUtil.setConfigurer(new Krb5HttpClientConfigurer());

I think this should be part of the SolrIndex class for janusgraph to work with kerberized solr. 

Thanks,

Sarath Subramanian

[HadoopMarc]

Sarath,

Thanks for reporting back!  If you would want to provide a PR, instructions are here. Your first line could probably be an external config, e.g. using the JAVA_OPTIONS. Your second line would probably need to be conditional. Hardest part would be providing a test suite. An example for testing kerberos functionality can be found here.

Cheers,    Marc

PS  I am not a JanusGraph committer, so it is probably wise to first contact the JanusGraph dev-list

Op donderdag 21 december 2017 06:09:12 UTC+1 schreef Sarath Kumar:

[Sandeep Mishra]

Hi Sarath,

I am using Janusgraph in embedded mode too. But having issues in connecting to a kerberized Hbase.

Could you please help me by providing any specific settings required by Hbase connectivity.

I have already done followings:

1. // Setting up the HBase configuration
2. Configuration configuration = new Configuration();
3. configuration.addResource("src/main/resources/hbase-site.xml");
4. UserGroupInformation.setConfiguration(configuration);
   
5. UserGroupInformation.loginUserFromKeytab(principal, keytabLocation)

//principal and keytabLocation is well defined.

Still it results in error from Janusgraph.

However, with same settings as above I am able to make a direct connection to HBase.

Am I missing something here?

Thanks and Regards,

Sandeep

[HadoopMarc]

Hi Sandeep,

Please post your question as a separate thread with appropriate title and including the stacktrace.

Thanks!   Marc

Op donderdag 21 december 2017 16:36:12 UTC+1 schreef Sandeep Mishra: