Providing Kerberos Credentials using a Keytab File
Configure Kerberos for the DataStax Enterprise (DSE) clients, including dsetool, DSE FS, DSE Graph, and DSE Spark.
Procedure
-
Create the keytab file with
kadmin:Start
kadmin:kadminCreate file:
ktadd -k <file_name> <principal_name> -
Log in using
kinit:kinit -k -t <file_name> <principal_name> -
Create a Java Authentication and Authorization Service (JAAS) configuration file for the DSE Client:
-
Create a file named
.java.login.configand put it in the home directory. -
Define the variables required to use a
keytabfile:DseClient { com.sun.security.auth.module.Krb5LoginModule required refreshKrb5Config=true useKeyTab=true keyTab="<file_name>" principal="<principal_name>"; };where
- keyTab
-
Absolute path to the
keytabfile. For example,/home/adam/krb5_opsc.keytab. - principal
-
The fully qualified
principal name. For example,dse_admin/dse1.lan@EXAMPLE.COM.
For more information on the available settings see the documentation for com.sun.security.auth.module.Krb5LoginModule.
-
-
Optional: If the JAAS configuration is not in the default location or has the default name, customize the location using one of the following methods:
