Adding Kerberos Support via TSaslClientTransport #100
Conversation
|
|
|
After doing some testing, I found that the keytab is actually unnecessary since you must kinit before running Python. I'll fix this and not require it. |
- Added a "sasl" dependency to requirements - Added working TSaslClientTransport - 2 (optional) arguments were added to the Connection class: :use_kerberos | signals to use secure authentication :sasl_service | name of the SASL service (default: hbase)
rickysaltzer
force-pushed
the
kerberos
branch
from
a4361e2
to
1c1e507
Compare
|
|
| @@ -9,11 +9,14 @@ | |||
| from thrift.transport.TSocket import TSocket | |||
| from thrift.transport.TTransport import TBufferedTransport, TFramedTransport | |||
| from thrift.protocol import TBinaryProtocol, TCompactProtocol | |||
| import sasl | |||
There was a problem hiding this comment.
This seems to install a C extension. Which system dependencies does that one have? Will it compile on any system?
There was a problem hiding this comment.
Dependencies are the cyrus-sasl extension. Those are available on every reasonable recent *nix system (ie. year 2000+ or so)
|
hi, thanks for your pr. i've added a bunch of (sometimes nitpicky) comments. |
|
Hi @wbolster and @rickysaltzer what's the status on this one? It looks really neat so I'd love to see in the official release (not that I cannot use it right now) |
|
Overall I would make the dependency optional, as py3 sasl support isn't really there yet. |
|
really sorry I haven't been able to devote much time to getting this release worthy. I'll try and find time as soon as I can. |
|
@rickysaltzer Any updates on this one? |
|
I've made a new PR, as this branch stopped working for me in a kerberized cluster. |
|
also, happybase is migrating to |
If you enable Kerberos by using
use_kerberos=True, then you must first remember tokinitbefore running your Python code.One thing still up in the air, is the requirement for sasl. Perhaps I should leave it out of the requirements and only import if the user has it installed. That way it doesn't force people who have no desire to connect to secure HBase clusters to have sasl installed.
I have tested this successfully against an HBase cluster secured with Kerberos.