Configuring SSO for the Cloudera Impala connector
With a single sign-on (SSO) solution, you can minimize the number of times a user has to log on to access apps and websites.
When you set up Cloudera Impala as a data source in Qlik Sense, you can configure Cloudera Impala for SSO. You store the Qlik Sense user credentials and define a trusted relationship so that the system passes the Qlik Sense credentials to Cloudera Impala.
Users who create apps using the Cloudera Impala Connector in the Qlik ODBC Connector Package can authenticate the connection with SSO. If the app data is loaded in-memory, access to the data is controlled from within Qlik Sense.
To configure SSO for Cloudera Impala, you must:
- Create the Cloudera Manager Principal.
- Set up a "Kerberized" Cloudera cluster.
- Install and configure Ranger.
- Test the configuration.
Creating the Cloudera Manager Principal
Do the following:
- Create an Organizational Unit (OU) in your Active Directory setup where all the principals used by your CDH cluster will reside.
-
Add a new user account to Active Directory to be used as the Cloudera Manager Principal.
The password should be set to never expire.
- Use Active Directory's Delegate Control wizard to allow this new user to Create, delete, and manage user accounts.
Setting up a "Kerberized" Cloudera cluster
Do the following:
- Use the Cloudera Kerberos wizard to set up Kerberos authentication for the Cloudera cluster running Impala.
- Configure the cluster so that the generic Cloudera Impala ODBC driver can connect using Kerberos principal authentication and can delegate connection to other users.
See the Cloudera documentation for details: Cloudera documentation
Install and configure Ranger
Ranger must be used for authorization.
Do the following:
- Install and configure the Ranger package.
- Verify that the Ranger service has been added to the Cloudera cluster.
- Configure Cloudera Impala to use Ranger.
Testing the configuration
On the system where Qlik Sense Enterprise on Windows is installed, create a connection to Cloudera Impala using the generic Cloudera ODBC driver.
If the connection works with the generic Cloudera ODBC driver, then connections made with the Cloudera Impala Connector in the ODBC Connector Package will also work.