[HBASE-20886] [Auth] Support keytab login in hbase client

• Type: New Feature
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Fix Version/s: 3.0.0-alpha-1, 2.2.0
• Component/s: asyncclient, Client, security
• Hadoop Flags: Reviewed

Release Note

From 2.2.0, hbase supports client login via keytab. To use this feature, client should specify `hbase.client.keytab.file` and `hbase.client.keytab.principal` in hbase-site.xml, then the connection will contain the needed credentials which be renewed periodically to communicate with kerberized hbase cluster.

• Assignee: Reid Chan
• Reporter: Reid Chan
• Created: 14/Jul/18 05:46
• Updated: 26/Aug/20 12:42
• Resolved: 04/Mar/19 09:07

Description

There're lots of questions about how to connect to kerberized hbase cluster through hbase-client api from user-mail and slack channel.

hbase.client.keytab.file and hbase.client.keytab.principal are already existed in code base, but they are only used in Canary.

This issue is to make use of two configs to support client-side keytab based login, after this issue resolved, hbase-client should directly connect to kerberized cluster without changing any code as long as hbase.client.keytab.file and hbase.client.keytab.principal are specified.

Issue Links

• causes: HBASE-24954 incorrect value for AuthUtil.HBASE_CLIENT_KERBEROS_PRINCIPAL
• relates to: HADOOP-9567 Provide auto-renewal for keytab based logins
• supercedes: HBASE-15779 Examples should use programmatic keytab auth