KB272699: How to configure connectivity to a secure CDH 5.4 cluster by leveraging delegation feature of Cloudera Impala ODBC driver for MicroStrategy Secure Enteprise 10.2 on Unix/Linux platforms

The following technical note explains the steps must be taken to configure connectivity to a secured CDH 5.4 cluster and leverage the delegation feature of the Cloudera Impala ODBC Driver to enforce access policy on users that are logged into Strategy Intelligence Server.
 
Notes: 

1. The Cloudera Impala ODBC driver has a connection parameter called DelegationUID, which can delegate all operations against Impala to a user that is different than the authenticated user for the connection.
2. By leveraging this delegation feature when connecting to a secured CDH 5.4 cluster, users can connect to Cloudera Impala via Kerberos ticket generated by one fixed user, for example, sysuser. During the connection, the DelegationUID parameter is used to pass a Strategy user ID (for example, userA, the user logged on from Strategy Developer or Web) in order to allow the authorized proxy user userA to execute queries through the connection established by sysuser.

 
Steps:

• Configure the Cloudera Impala clusters to use sentry to use “DelegationUid” and an authorized proxy user. For more information, see the following Cloudera documentation:
   
  
• Sentry for Hive Authorization page
• Setting Up Hive Authorization with Sentry page
• Install Kerberos 5 libraries on the machine hosting Strategy Intelligence Server. The UNIX/Linux operating system may come with Kerberos installed and if so this step can be skiped. For steps on how to install these libraries, users should refer to the Kerberos documentation for their specific Operating System.
• Configure the KRB5.conf file which is pointed to by the KRB5_CONFIG envrionment variable. If it doesn't exist, users can create the file and then set the environment variable themselves. An example is below:
  

  
  [libdefaults]
  default_realm = <DOMAIN REALM>
  default_keytab_name = /etc/krb5.keytab
  forwardable = true
  no_addresses = true
  [realms]
  <DOMAIN_REALM> = { 
     kdc = DC_IPAddress:88
     admin_server = DC_Admin_IPAddress:749
  }
  [domain_realm]
  .domain_realm = DOMAIN_REALM
  domain_realm = DOMAIN_REALM
  

  
  
• DOMAIN REALM: The domain realm used for authentication purposes. A domain realm is commonly of the form example.com.
  Note: The capitalization of DOMAIN_REALM must match the capitalization used in the syntax for krb5.conf listed above. For example, if DOMAIN_REALM is in uppercase, include the domain realm in uppercase. 
• DC_IPAddress: The IP address of the Kerberos KDC or the Windows machine that hosts the Active Directory domain controller. This can be the same IP address as DC_Admin_IPAddress.
  Note: The Port number may not need to be specified for the KDC parameter. 
• DC_Admin_IPAddress: The IP address of the Windows machine that hosts the Active Directory domain controller admin server. This can be the same IP address as DC_IPAddress.
• Create a TGT(ticket granting ticket) for the connectivity to Cloudera Impala. The user can do this by running 'kinit <Principal Name>'. Users should make sure that the KRB5CCNAME environment variable is set and pointing to the desired location for the credentials cache to be saved.
  Note: This principal should be enabled with access to Cloudera Impala and act as the delegating user as configured in step (1), the fixed user whose ticket will be used to establish the connection. Take sysuser as an example, to run command kinit sysuser@kdcserver.com.
• Configure the Database Instance in Strategy Developer.
  
• Create an ODBC DSN using Cloudera Impala ODBC driver v2.5.29 or higher and set the authentication mechanism as Kerberos.
• Create a Database Instance with the newly created DSN.
• Modify the Database connection in the Database instance to set the "additional connection string parameters"  to include delegationuid=?delegated_mstr_uid as shown below.
  
  

• The ?delegated_mstr_uid wildcard will be replaced at run-time with the currently logged on Strategy user ID which will act as the delegated user when connecting to Cloudera Impala.
• Configure the Database Login for the Database Connection object configured above to "use network login id(Windows Authentication)"

 
Users should now be able to leverage the delegation feature of the Cloudera Impala ODBC Driver to enforce access policy on users that are logged into the Strategy Intelligence Server. 
KB272699