Add Keytab Support to HDFS Connection

[jyeh]

This is the screen when trying to access HDFS through Alteryx:

When publishing a workflow that contains the user ID and using Kerberos, one would need to login to the Alteryx server and run the MIT Kerberos Ticket Manager.

It would be a great enhacement to add the possibility to allow the users to use the keytab file to authenticate alongside the existing authentication.

So, if one checks "Use Kerberos", there would be an option text box that would allow the user to select the keytab file. That would ensure that the ticket is always valid and there is no need to login to the server to renew the kerberos ticket every day manually (!).

[-t keytab_file]

Ref: https://kb.iu.edu/d/aumh

http://web.mit.edu/Kerberos/krb5-devel/doc/user/user_commands/kinit.html

Does anyone have any workarounds?

[jyeh]

A possible workaround would be to run the following 

C:\Program Files\MIT\Kerberos\bin\kinit -k -t C:\kerberos\user.keytab principal@DOMAIN.TLD either on a Run Command tool and schedule to run periodically

[aser]

@jyeh I tried the way to generate a batch file, but if I executed it I get a error message.

kinit: Unsupported key table format version number while getting initial credentials

Can you paste your commangs how you created the keytab in the hadoop please

[jyeh]

With Alteryx v.11, this is less of an issue since Kerberos SSPI and MIT were added to the tool.

However, if you are trying to generate the keytab try the following:

$ ktutil
ktutil: addent -password -p your_id@DOMAIN.COM -k 1 -e aes256-cts
Password for your_id@DOMAIN.COM:
ktutil: addent -password -p your_id@DOMAIN.COM -k 1 -e rc4-hmac
Password for your_id@DOMAIN.COM:
ktutil: wkt your_id.keytab
ktutil: quit

[aser]

Thank it works for me now.

I use the option Kerberos MIT but for this option I need at first to generate a kerberos ticket or do it alteryx for me?

[jyeh]

Before Alteryx v.11, I used the Kerberos MIT option too. You will need to generate the ticket outside Alteryx through MIT Ticket Manager or the command to kinit as described in the prior post.

Good luck.