13.1. Presto Coordinator Kerberos Authentication

The Presto coordinator can be configured to enable Kerberos authentication over HTTPS for clients, such as the Presto CLI, or the JDBC and ODBC drivers.

Warning

Worker nodes cannot yet be configured to connect to the Presto coordinator using HTTPS or to authenticate with Kerberos. It is the administrator’s responsibility to enable unauthenticated access over HTTP for worker nodes and ensure unathenticated access is blocked for any node that is not a worker node. For nodes that are not worker nodes, block access to the Presto coordinator’s HTTP port.

To enable Kerberos authentication for Presto, configuration changes are made on the Presto coordinator. No changes are required to the worker configuration; the worker nodes will continue to connect to the coordinator over unauthenticated HTTP.

Environment Configuration

Kerberos Services

You will need a Kerberos KDC running on a node that the Presto coordinator can reach over the network. The KDC is responsible for authenticating principals and issuing session keys that can be used with Kerberos-enabled services. KDCs typically run on port 88, which is the IANA-assigned port for Kerberos.

Kerberos Configuration

Kerberos needs to be configured on the Presto coordinator At a minimum, there needs to be a kdc entry in the [realms] section of the /etc/krb5.conf file. You may also want to include an admin_server entry and ensure that the Presto coordinator can reach the Kerberos admin server on port 749.

[realms]
  PRESTO.EXAMPLE.COM = {
    kdc = kdc.example.com
    admin_server = kdc.example.com
  }

[domain_realm]
  .presto.example.com = PRESTO.EXAMPLE.COM
  presto.example.com = PRESTO.EXAMPLE.COM

The complete documentation for krb5.conf is hosted by the MIT Kerberos Project.

Kerberos Principals and Keytab Files

The Presto coordinator needs a Kerberos principal, as do users who are going to connect to the Presto coordinator. You will need to create these users in Kerberos using kadmin.

In addition, the Presto coordinator needs a keytab file. After you create the principal, you can create the keytab file using kadmin

kadmin
> addprinc -randkey presto@EXAMPLE.COM
> addprinc -randkey presto/presto-coordinator.example.com@EXAMPLE.COM
> ktadd -k /etc/presto/presto.keytab presto@EXAMPLE.COM
> ktadd -k /etc/presto/presto.keytab presto/presto-coordinator.example.com@EXAMPLE.COM

Note

Running ktadd randomizes the principal’s keys. If you have just created the principal, this does not matter. If the principal already exists, and if existing users or services rely on being able to authenticate using a password or a keytab, use the -norandkey option to ktadd.

Java Cryptography Extension Policy Files

The Java Runtime Environment is shipped with policy files that limit the strengh of the cryptographic keys that can be used. Kerberos, by default, uses keys that are larger than those supported by the included policy files. There are two possible solutions to the problem:

  • Update the JCE policy files.
  • Configure Kerberos to use reduced-strength keys.

Of the two options, updating the JCE policy files is recommended. The JCE policy files can be downloaded from Oracle. Note that the JCE policy files vary based on the major version of Java you are running. Java 6 policy files will not work with Java 8, for example.

The Java 8 policy files are available here. Instructions for installing the policy files are included in a README file in the zip archive. You will need administrative access to install the policy files if you are installing them in a system JRE.

Java Keystore File for TLS

When using Kerberos authentication, access to the Presto coordinator should be through HTTPS. The Presto coordinator needs keys to secure the TLS connection. These keys are generated using keytool and stored in a Java Keystore file for the Presto coordinator.

The alias in the keytool command line should match the principal that the Presto coordinator will use.

You’ll be prompted for the first and last name. Use the Common Name that will be used in the certificate. In this case it should be the unqualified hostname of the Presto coordinator. In the example, you can see this in the prompt that confirms the information is correct.

keytool -genkeypair -alias presto -keyalg RSA -keystore keystore.jks
Enter keystore password:
Re-enter new password:
What is your first and last name?
  [Unknown]:  presto-coordinator
What is the name of your organizational unit?
  [Unknown]:
What is the name of your organization?
  [Unknown]:
What is the name of your City or Locality?
  [Unknown]:
What is the name of your State or Province?
  [Unknown]:
What is the two-letter country code for this unit?
  [Unknown]:
Is CN=eiger, OU=Unknown, O=Unknown, L=Unknown, ST=Unknown, C=Unknown correct?
  [no]:  yes

Enter key password for <presto>
        (RETURN if same as keystore password):

Access Controller Implementation

Presto separates the concept of the principal who authenticates to the coordinator from the username that is responsible for running queries. When running the Presto CLI, for example, the Presto username can be specified using the –user option.

By default, the Presto coordinator allows any principal to run queries as any Presto user. In a secure environment, this is probably not desirable behavior.

This behavior can be customized by implementing the SystemAccessControlFactory and SystemAccessControl interfaces.

SystemAccessControlFactory is responsible for creating a SystemAccessControl instance. It also defines a SystemAccessControl name which is used by the administrator in a Presto configuration.

SystemAccessControl implementations have two responsibilities:
  • Verifying whether or not a given Kerberos principal is authorized to execute queries as a specific user.
  • Determining whether or not a given user can alter values for a given system property.

The implementation of SystemAccessControl and SystemAccessControlFactory must be wrapped as a plugin and installed on the Presto cluster.

Presto Coordinator Node Configuration

You must make the above changes to the environment prior to configuring the Presto coordinator to use Kerberos authentication and HTTPS. After making the following environment changes, you can make the changes to the Presto configuration files.

config.properties

Kerberos authentication is configured in the coordinator node’s config.properties file. The entries that need to be added are listed below.

http.server.authentication.enabled=true

http.server.authentication.krb5.service-name=presto
http.server.authentication.krb5.keytab=/etc/presto/presto.keytab
http.authentication.krb5.config=/etc/krb5.conf

http-server.https.enabled=true
http-server.https.port=7778

http-server.https.keystore.path=/etc/presto_keystore.jks
http-server.https.keystore.key=keystore_password
Property Description
http.server.authentication.enabled Enable authentication for the Presto coordinator. Must be set to true.
http.server.authentication.krb5.service-name The Kerberos server name for the Presto coordinator. Must match the Kerberos principal.
http.server.authentication.krb5.keytab The location of the keytab that can be used to authenticate the Kerberos principal specified in http.server.authentication.krb5.service-name.
http.authentication.krb5.config The location of the Kerberos configuration file.
http-server.https.enabled Enables HTTPS access for the Presto coordinator. Should be set to true.
http-server.https.port HTTPS server port.
http-server.https.keystore.path The location of the Java Keystore file that will be used to secure TLS.
http-server.https.keystore.key The password for the keystore. This must match the password you specified when creating the keystore.

access-controls.properties

Once a plugin that implements SystemAccessControl and SystemAccessControlFactory has been installed on the coordinator, it is configured using an access-controls.properties file. All of the properties other than access-control.name are specific to the SystemAccessControl plugin.

access-control.name=custom-access-control
custom-property1=custom-value1
custom-property2=custom-value2
...

The access-control.name property is used by Presto to find a registered SystemAccessControlFactory. The remaining properties are passed as a map to SystemAccessControlFactory.create(Map<String, String> config).

Troubleshooting

Getting Kerberos authentication working can be challenging. You can independently verify some of the configuration outside of Presto to help narrow your focus when trying to solve a problem.

Kerberos Verification

Ensure that you can connect to the KDC from the Presto coordinator using telnet.

$ telnet kdc.example.com 88

Verify that the keytab file can be used to successfully obtain a ticket using kinit and klist

$ kinit -kt /etc/presto/presto.keytab presto@EXAMPLE.COM
$ klist

Java Keystore File Verification

Verify the password for a keystore file and view its contents using keytool.

$ keytool -list -v -k /etc/presto/presto.jks

Additional Kerberos Debugging Information

You can enable additional Kerberos debugging information for the Presto coordinator process by adding the following lines to the Presto jvm.config file

-Dsun.security.krb5.debug=true
-Dlog.enable-console=true

-Dsun.security.krb5.debug=true enables Kerberos debugging output from the JRE Kerberos libraries. The debugging output goes to stdout, which Presto redirects to the logging system. -Dlog.enable-console=true enables output to stdout to appear in the logs.

The amount and usefulness of the information the Kerberos debugging output sends to the logs varies depending on where the authentication is failing. Exception messages and stack traces can also provide useful clues about the nature of the problem.