[HBASE-14400] Fix HBase RPC protection documentation

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Fix Version/s: 1.2.0, 1.3.0, 0.98.15, 1.0.3, 1.1.3, 2.0.0
• Component/s: encryption, IPC/RPC, security
• Hadoop Flags: Reviewed

Release Note

To use rpc protection in HBase, set the value of 'hbase.rpc.protection' to:
'authentication' : simple authentication using kerberos
'integrity' : authentication and integrity
'privacy' : authentication and confidentiality

Earlier, HBase reference guide erroneously mentioned in some places to set the value to 'auth-conf'. This patch fixes the guide and adds temporary support for erroneously recommended values.

• Assignee: Apekshit Sharma
• Reporter: Apekshit Sharma
• Created: 10/Sep/15 19:50
• Updated: 27/Jan/16 15:28
• Resolved: 16/Sep/15 01:56

Description

HBase configuration 'hbase.rpc.protection' can be set to 'authentication', 'integrity' or 'privacy'.
"authentication means authentication only and no integrity or privacy; integrity implies
authentication and integrity are enabled; and privacy implies all of
authentication, integrity and privacy are enabled."

However hbase ref guide incorrectly suggests in some places to set the value to 'auth-conf' instead of 'privacy'. Setting value to 'auth-conf' doesn't provide rpc encryption which is what user wants.

This jira will fix:

• documentation: change 'auth-conf' references to 'privacy'
• SaslUtil to support both set of values (privacy/integrity/authentication and auth-conf/auth-int/auth) to be backward compatible with what was being suggested till now.
• change 'hbase.thrift.security.qop' to be consistent with other similar configurations by using same set of values (privacy/integrity/authentication).