Prerequisites

For secure impersonation to work, the following conditions also must be met:

• The cluster must be configured with Kerberos security.

• The cluster must have a Kerberos principal that represents Pentaho that can authenticate to the cluster services and have privileges to impersonate.

• Job or transformation requests must come from the Pentaho Server to the cluster to use secure impersonation.

• The cluster components must support secure impersonation.

Pentaho support for secure impersonation is determined by whether the Hadoop components support secure impersonation. If the Hadoop component does not support secure impersonation, then Kerberos authentication is used.

Note: The cluster administrator is responsible for setting up the cluster users and the Kerberos servers. See the Cloudera documentation for instructions on setting up cluster users. Also see the Apache Hadoop security documentation.