Support for Kerberos connection

Question

Support for Kerberos connection

feenst opened this issue 7 years ago · 7 comments

I'm evaluating node-hbase for connecting to an HBase instance, but it's using REST rather than Thrift to connect.

Has Kerberos support for node-thirft2-hbase been discussed?

Answer 1 · 2017-09-06T04:50:39.000Z

We haven't discussed Kerberos support, nor do I expect this to get into our development plans any time soon... You can, however, easily swap the connection pool we have now with a Kerberos connection pool. You are more than welcome to fork and submit a PR, and we'll be glad to help.

…

On 6 Sep 2017 4:40 AM, "feenst" ***@***.***> wrote: I'm evaluating node-hbase <https://github.com/adaltas/node-hbase> for connecting to an HBase instance, but it's using REST rather than Thrift to connect. Has Kerberos support for node-thirft2-hbase been discussed? — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#11>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AG8XebyExq9HRQl7-TEm7gIy8Uj87Gwvks5sffgkgaJpZM4PNutS> .

Answer 2 · 2017-09-07T00:48:03.000Z

@moshewe, I'm not sure where to start on swapping out the connection pool. Would that be something here?

Answer 3 · 2017-09-07T04:34:13.000Z

Yes. You can see that in the `create` callback given to the pool it creates a `Client` object. You can change that to a Kerberos client connection.

…

On 7 Sep 2017 3:48 AM, "feenst" ***@***.***> wrote: @moshewe <https://github.com/moshewe>, I'm not sure where to start on swapping out the connection pool. Would that be something here <https://github.com/exposebox/node-thrift2-hbase/blob/master/src/client.js#L45> ? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#11 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AG8XeSJZAPLVBJMDYjW_wE-1r8fQV1gtks5sfz1EgaJpZM4PNutS> .

Answer 4 · 2017-09-07T07:52:34.000Z

In client.js line 147 the connection to the thrift server is created.
The createConnection is in the node-thrift package, It just create a stream using net.createConnection.
You can add your function of createKerberosConnection :

thrift.createKerberosConnection = function(host, port, options) {
  var stream = kerberos.connect(port, host, options);
  var connection = new Connection(stream, options);
  connection.host = host;
  connection.port = port;
  return connection;
};

Answer 5 · 2017-09-13T02:51:18.000Z

@Ran-P, the Node kerberos packages I've seen (kerberos and node-krb5) both seem to work by generating a token that's used with an Authentication HTTP header.

The thrift connection uses sockets / streams. Any idea how Kerberos authentication works in that scenario?

Answer 6 · 2017-09-13T04:36:43.000Z

As @Ran-P pointed out, you should discuss this with the node-thrift people. If you figure something out with them, then you can see exactly where @Ran-P had already directed you to how to use it with our package - it's just a library for us.

Answer 7 · 2017-09-13T08:03:02.000Z

@feenst you can use httpConnection in the thrift library instead of the RPC connection.
Add(or extend) to the httpConnection to use krb5.