Security parameters (cdap-site.xml and cdap-default.xml)
Parameter Name | Default Value | Description |
---|---|---|
| Â | The full path to the Kerberos keytab file containing the CDAP Master service's credentials |
|
| Determines the mode of authentication to use if security is enabled. Supported modes include MANAGED and PROXY. MANAGED mode supports a CDAP-managed authentication server and uses CDAP's access tokens to authenticate the user. PROXY mode assumes that authentication has already been performed upstream and instead extracts the user's identity and credentials from the configured headers. |
|
| Determines whether credentials in the Authorization header of requests are propagated from the request router to the rest of the backend handlers. Should be false unless the authorization extension requires the end-user credential to authorize users. |
|
| The header to extract the user identity from. The user identity header must be provided for PROXY mode to function, and CDAP requires that the header must be set on all requests to the backend. |
| Â | Example: "CDAP_PRINCIPAL/_HOST@EXAMPLE.COM". The Kerberos primary user that should be used to login to the CDAP Master service. Substitute the Kerberos primary (user) for CDAP_PRINCIPAL, and your domain for EXAMPLE.COM. The string "_HOST" will be substituted with the local hostname. |
|
| UserGroupInformation cache entry expiration time in milliseconds. It is only used when impersonation is enabled. |
|
| Determines if Kerberos authentication is enabled. |
|
| Re-login interval in seconds for Kerberos keytab. |
| Â | CDAP Authentication service announce URL's separated by comma. Each URL is in the format of protocol://host:port. These are the URL's that clients should use to communicate with the Authentication Server. Leave empty to use the default value generated by the Authentication Server. |
|
| CDAP Authentication service bind address. |
|
| CDAP Authentication service bind port. |
|
| CDAP Authentication service bind port for HTTPS. |
| Â | Username and password file to use when basic authentication is configured. |
| Â | Name of the authentication implementation to use to validate user credentials. |
|  | JAAS LoginModule implementation to use when io.cdap.security.server.JAASAuthenticationHandler is configured for |
|
| Number of entries to hold in the container authorization cache. If set to 0, no caching will be performed. |
|
| Number of entries to hold in the container authorization cache. If set to 0, no caching will be performed. |
|
| The time-to-live in seconds for entries in the authorization cache used by programs and system services outside of CDAP Master. |
|
| The time-to-live in seconds for entries in the authorization cache used by programs and system services outside of CDAP Master. |
|
| When set to true, all operations in CDAP are authorized using the authorizer implementation found at the property |
|  | If an external authorization system is used for authorizing operations on CDAP entities, this property sets the path to the bundled JAR file containing the extension code. This jar is only used when authorization is enabled by setting |
|
| Time taken by an authorization extension to perform an enforce operation is recorded and logged at TRACE level. This property sets the upper limit for the time taken by the extension in milliseconds after which it is logged at WARN level rather than TRACE. |
|
| Path to the secret key file (only used in CDAP Local Sandbox). |
|
| Determines if authentication is enabled for CDAP; if true, all requests to CDAP must provide a valid access token. |
|  | The location of Kerberos keytabs used for impersonation. The location can contain |
|
| Authentication realm used for scoping security; this value should be unique for each installation of CDAP. |
|
| Admin tool access token expiration time in milliseconds; defaults to 1 week (internal). |
|
| Maximum number of threads that the CDAP Authentication service should use for handling HTTP requests. |
|
| Access token expiration time in milliseconds; defaults to 24 hours. |
|
| Name of the secure store file. |
|
| Semicolon-separated list of local directories that are scanned for secure store extensions. |
|
| Location of the encrypted file which holds the secure store entries. |
|
| Backend provider for the secure store. Values can be |
|
| Algorithm used for generating MAC of access tokens. |
|
| Duration in milliseconds after which an active secret key used for signing tokens should be retired. |
|
| Key length used in generating the secret keys for generating MAC of access tokens. |
|
| Parent node in ZooKeeper used for secret key distribution in Distributed CDAP. |
|
| Enable SSL for external services. |
|
| Enable SSL between internal services. |
| Â | File path to certificate and private key file in PEM format to use when ssl.internal.enabled is set to true. |
Created in 2020 by Google Inc.