Applies to:
Kyvos Enterprise 
Kyvos Azure Marketplace
Kyvos AWS Marketplace Kyvos Free (
The Security configuration page enables you to configure the security for the Kyvos cluster.
Hadoop Authentication Configuration
Use the fields here to configure security configurations for the Hadoop cluster.
The fields displayed in the following figure are displayed ONLY if you select the KERBEROS option.
Hadoop Authentication Configuration area
In the Hadoop Authentication Configuration area, enter the following information.
- From the Hadoop Security Type list, select the option as configured on the Hadoop cluster. If no security is configured on Hadoop, select SIMPLE.
- If you select the KERBEROS option, then:
- Select the check boxes for Key Distribution Center (KDC) configurations.
- Enter Keytab User Name for Kerberos.
- Keytab available on all hosts: Select this check box if the keytab file is available on all host nodes. A keytab is a file containing pairs of Kerberos principals and encrypted keys (which are derived from the Kerberos password). You can use a keytab file to authenticate to various remote systems using Kerberos without entering a password.
- Enter the path of the Keytab File.
Enter the name of the Keytab File.
If the keytab file is not available on host nodes, use the Change file button to upload the keytab file to connect to Hadoop.
- Click the Validate KeyTab to confirm if the file exists on the hosts.
Upload the Local policy jar file from your computer network.
IMPORTANT
Local policy or US export policy jars enable Kyvos to work with secure Hadoop.
Due to import control restrictions for some countries, the Java Cryptography Extension (JCE) policy files shipped with the Java SE Development Kit and the Java SE Runtime Environment allow strong but limited cryptography to be used. An unlimited strength version of these files indicating no restrictions on cryptographic strengths is available on the JDK website according to the jurisdiction of your country. Those living in eligible countries may download the unlimited strength version and replace the strong cryptography jar files with the unlimited strength files.
For this, download the Java Cryptography Extension (JCE) file.
Unzip the jce_policy-8.zip file, to access the US_export_policy.jar and local_policy.jar to upload to Kyvos Manager.
Kyvos Preferences
From the Kyvos Preferences list, select any one of the following:
- Keytab Principal User
- Kyvos Logged in User
You can specify Kyvos User preferences for Hadoop access as either Keytab Principal User with administrative rights or Kyvos Logged-in User with specific access rights to perform activities as per the user's privileges. This user is used for all activities requiring Hadoop access by Kyvos, such as Dataset Preview and the semantic model process.
Network Configuration
Kyvos supports TLS communication with Mutual Authentication for all internal communications and authentication-related information. Mutual authentication is used when the server wants to authenticate the client as a trusted partner. The server requests mutual authentication, and the client needs to present its certificate to the server while establishing the connection.
The following figure displays the Network Protocol Configurations area.
You can also define HTTP2 configuration from the Network Protocol Configurations area. Further, you can specify HTTP2 configuration for the Kyvos Web portal even if TLS is not enabled.
TLS Configuration area
Enter details as:
Parameter/Field | Comments/Description |
|---|---|
Enable TLS | Select to enable secure communication (TLS) between client and server. |
| HTTP Protocol Version | Select the HTTP Protocol to use. Before enabling HTTP2, ensure that the prerequisites are completed. |
| TLS Protocol | Select the version for SSL/TLS protocol to be used. For multiple versions, select the corresponding check boxes. |
| TLS Certificate mode | Select the certificate mode. You can upload a file or provide the path. |
Keystore | Provide the location of the keystore file. This file is used by the server when secure communication is enabled and required by the client when mutual authentication is enabled. |
Keystore Private Key | Enter the keystore password. |
Truststore | Provide the location (path) to read the trust store file. This file is required by the client when secure communication is enabled and required by the server when mutual authentication is enabled. |
Truststore Private Key | Enter the truststore password. |
Cipher Suite | Enter the encryption algorithm to be used for communication over the TLS layer. |
Enable Mutual Authentication | Select to enable mutual authentication. |
Kyvos Web Portal Configuration Certificate | Use Same Certificate as TLS: Select to use the same certificate for TLS and Web portal authentication. |
| HTTP2 Configuration | APR Lib Path: Provide the absolute path for Apache Portable Runtime library. |
| Attributes for HTTP2 over TLS connector | Here, provide values for the following parameters:
|