Proxy users and delegation tokens

An alternative to granting HDFS access to individual OpenText™ Analytics Database users is to use delegation tokens, either directly or with a proxy user. In this configuration, the database accesses HDFS on behalf of some other (Hadoop) user. The Hadoop users need not be database users at all.

In OpenText™ Analytics Database, you can either specify the name of the Hadoop user to act on behalf of (doAs), or you can directly use a Kerberos delegation token that you obtain from HDFS (Bring Your Own Delegation Token). In the doAs case, the database obtains a delegation token for that user, so both approaches ultimately use delegation tokens to access files in HDFS.

Use the HadoopImpersonationConfig session parameter to specify a user or delegation token to use for HDFS access. Each session can use a different user and can use either doAs or a delegation token. The value of HadoopImpersonationConfig is a set of JSON objects.

To use delegation tokens of either type (more specifically, when HadoopImpersonationConfig is set), you must access HDFS through WebHDFS.