ApiAuthSpec Data Model

Specifies how to authenticate before obtaining delegation tokens.

Only one authentication approach is active at a time, indicated by authType.

  • AuthType#CUSTOM_KEYTAB: authenticate with keytabPath and principal — a local path on the SCM server host.
  • AuthType#LOCAL_SERVICE_KEYTAB: authenticate using the keytab of the executor service (the HDFS or Ozone service identified by the URL path parameters). No extra fields needed.
  • AuthType#KERBEROS_CREDENTIALS_ENDPOINT: call the /{serviceName/kerberosCredentials} CM API endpoint of service to obtain a fresh TGT. The service may be on the local cluster (no peerName) or on a remote cluster (with peerName).

Properties
name data type description
authType AuthType The authentication approach to use.
keytabPath string Local path on the SCM server host to the keytab file.

Required for AuthType#CUSTOM_KEYTAB; ignored otherwise.

principal string Kerberos principal to authenticate as.

Required for AuthType#CUSTOM_KEYTAB; ignored otherwise.

service ApiServiceRef The service whose /kerberosCredentials endpoint is called to obtain a fresh TGT.

The service may be local (no peerName) or remote (peerName set). Required for AuthType#KERBEROS_CREDENTIALS_ENDPOINT; ignored otherwise.

Example

{
  "authType" : "KERBEROS_CREDENTIALS_ENDPOINT",
  "keytabPath" : "...",
  "principal" : "...",
  "service" : {
    "peerName" : "...",
    "clusterName" : "...",
    "clusterDisplayName" : "...",
    "serviceName" : "...",
    "serviceDisplayName" : "...",
    "serviceType" : "..."
  }
}