Presto配置LDAP认证 & Kylin配置Presto下压

005_Presto配置LDAP及Kylin的下压配置

---

一、启用LDAPS

1、创建ApacheDS服务端使用的keystone

1. 创建keystore

cd apacheds-2.0.0-M25/default/conf/

keytool -genkeypair -alias apacheds -keyalg RSA -validity 90 -keystore ads.keystore 

输入密钥库口令:  
再次输入新口令: 

您的名字与姓氏是什么?
  [Unknown]:  dw303
您的组织单位名称是什么?
  [Unknown]:  dwStudy
您的组织名称是什么?
  [Unknown]:  study
您所在的城市或区域名称是什么?
  [Unknown]:  shanghai
您所在的省/市/自治区名称是什么?
  [Unknown]:  shanghai
该单位的双字母国家/地区代码是什么?
  [Unknown]:  CN
CN=dw303, OU=dwStudy, O=study, L=shanghai, ST=shanghai, C=CN是否正确?
  [否]:  是

输入 <apacheds> 的密钥口令
        (如果和密钥库口令相同, 按回车):  
再次输入新口令:

Warning:
JKS 密钥库使用专用格式。建议使用 "keytool -importkeystore -srckeystore ads.keystore -destkeystore ads.keystore -deststoretype pkcs12" 迁移到行业标准格式 PKCS12。

2. 修改文件权限

sudo chown apacheds:apacheds ads.keystore

2、导出证书

keytool -export -alias apacheds -keystore ads.keystore -rfc -file ads.cer

输入密钥库口令:  
存储在文件 <ads.cer> 中的证书

3、导入系统证书库

• 将证书导入系统证书库，实现自认证

keytool -import -file ads.cer -alias apacheds -keystore /usr/lib/jvm/java-1.8.0/jre/lib/security/cacerts -storepass changeit

4、启用LDAPS

1. 使用Apache Directory Studio连接集群上的ApacheDS服务
2. 打开配置页
   
3. 启用LDAPS，将创建好的keystore配置到图示位置，保存配置（ctrl + s）
   
4. 登录服务器重启ApacheDS服务

./bin/apacheds.sh stop
./bin/apacheds.sh start

• LDAPS已启动，服务端口默认为10636

二、创建用户信息

1、创建分区

• 打开配置页，创建 dc=hadoop,dc=apache,dc=org 分区，如下图所示
  
• 登录服务器重启ApacheDS服务，使配置生效

2、创建用户

1. 创建以下文件：users.ldif

# Entry for a sample people container
# Please replace with site specific values
dn: ou=people,dc=hadoop,dc=apache,dc=org
objectclass:top
objectclass:organizationalUnit
ou: people

# Entry for a sample end user
# Please replace with site specific values
# dn: uid=guest,ou=people,dc=hadoop,dc=apache,dc=org
# objectclass:top
# objectclass:person
# objectclass:organizationalPerson
# objectclass:inetOrgPerson
# cn: Guest
# sn: User
# uid: guest
# userPassword:guest-password

# entry for sample user admin
dn: uid=admin,ou=people,dc=hadoop,dc=apache,dc=org
objectclass:top
objectclass:person
objectclass:organizationalPerson
objectclass:inetOrgPerson
cn: Admin
sn: Admin
uid: admin
userPassword:123456

# entry for sample user presto
dn: uid=presto,ou=people,dc=hadoop,dc=apache,dc=org
objectclass:top
objectclass:person
objectclass:organizationalPerson
objectclass:inetOrgPerson
cn: Presto
sn: Presto
uid: presto
userPassword:123456


# create FIRST Level groups branch
dn: ou=groups,dc=hadoop,dc=apache,dc=org
objectclass:top
objectclass:organizationalUnit
ou: groups
description: generic groups branch

# create the analyst group under groups
dn: cn=analyst,ou=groups,dc=hadoop,dc=apache,dc=org
objectclass:top
objectclass: groupofnames
cn: analyst
description:analyst  group
member: uid=sam,ou=people,dc=hadoop,dc=apache,dc=org
member: uid=tom,ou=people,dc=hadoop,dc=apache,dc=org


# create the scientist group under groups
dn: cn=scientist,ou=groups,dc=hadoop,dc=apache,dc=org
objectclass:top
objectclass: groupofnames
cn: scientist
description: scientist group
member: uid=sam,ou=people,dc=hadoop,dc=apache,dc=org

2. 在Apache Directory Studio中导入上述文件，成功后可查看添加的用户信息
   
   

三、配置Presto

1、创建Presto coordinator的keystore

keytool -genkeypair -alias presto -keyalg RSA -validity 90 -keystore presto.keystore 

2、修改Presto配置

2.1. 修改 config.properties

http-server.authentication.type=PASSWORD
http-server.https.enabled=true
http-server.https.port=8443
http-server.https.keystore.path=${PRESTO_HOME}/keystore
http-server.https.keystore.key=123456

2.2. 修改 jvm.config

-Djavax.net.ssl.trustStore=/usr/lib/jvm/java-1.8.0/jre/lib/security/cacerts
-Djavax.net.ssl.trustStorePasswond=changeit

2.3. 新建 password-authenticator.properties

password-authenticator.name=ldap
ldap.url=ldaps://dw303:10636
ldap.user-bind-pattern=uid=${USER},ou=people,dc=hadoop,dc=apache,dc=org

2.4. 新建 jndi.properties

java.naming.security.principal=uid=admin,ou=system
java.naming.secunity.credentials=secret
java.naming.secunity.authentication=simple

2.5. 打包 jndi.properties

• 将 jndi.properties 打包为jar包，并复制到 ${PRESTO_HOME}/lib

jar -cvf jndi-properties.jar jndi.properties

• 重启Presto，LDAPS配置生效

四、配置Kylin

1. 将 presto.keystore 复制到 ${KYLIN_HOME}/tomcat/conf 下，重命名为 .keystore
2. 编辑 kylin.properties ，修改下压配置

• 官方已提供补丁，可通过 KYLIN-4491 引入

####QUERY PUSH DOWN ####

kylin.query.pushdown.runner-class-name=org.apache.kylin.query.pushdown.PushdownRunnerSDKImpl
kylin.source.jdbc.dialect=presto
kylin.source.jdbc.adaptor=org.apache.kylin.sdk.datasource.adaptor.PrestoAdaptor
kylin.query.pushdown.jdbc.url=jdbc:presto://hostname:8443/hive?SSL=true
kylin.query.pushdown.jdbc.driver=com.facebook.presto.jdbc.PrestoDriver
kylin.query.pushdown.jdbc.username=presto
kylin.query.pushdown.jdbc.password=123456
kylin.query.pushdown.jdbc.pool-max-total=150
kylin.query.pushdown.jdbc.pool-max-idle=100
kylin.query.pushdown.jdbc.pool-min-idle=50

• 未打补丁也可以按如下配置，亲测可生效

####QUERY PUSH DOWN ####

kylin.query.pushdown.runner-class-name=org.apache.kylin.query.adhoc.PushDownRunnerJdbcImpl 
kylin.query.pushdown.jdbc.url=jdbc:presto://hostname:8443/hive?SSL=true
kylin.query.pushdown.jdbc.driver=com.facebook.presto.jdbc.PrestoDriver
kylin.query.pushdown.jdbc.username=presto 
kylin.query.pushdown.jdbc.password=123456
kylin.query.pushdown.jdbc.pool-max-total=150
kylin.query.pushdown.jdbc.pool-max-idle=100
kylin.query.pushdown.jdbc.pool-min-idle=50