[docs] Clean-up the HBase configuration section
@@ -862,9 +862,10 @@ Specify the comma-separated list of HBase Thrift servers for clusters in the for
[hbase]
hbase_clusters=(Cluster|localhost:9090)
-HBase Impersonation:
+### Impersonation
-Enable impersonation for the Thrift server by adding the following properties to hbase-site.xml on each Thrift gateway:
+doAs Impersonation provides a flexible way to use the same client to impersonate multiple principals. doAs is supported only in Thrift 1.
+Enable doAs support by adding the following properties to hbase-site.xml on each Thrift gateway:
<property>
<name>hbase.regionserver.thrift.http</name>
@@ -875,20 +876,37 @@ Enable impersonation for the Thrift server by adding the following properties to
<value>true/value>
</property>
+And the Hue hosts, or * to authorize from any host:
+
+ <property>
+ <name>hadoop.proxyuser.hbase.hosts</name>
+ <value>*</value>
+ </property>
+ <property>
+ <name>hadoop.proxyuser.hbase.groups</name>
+ <value>*/value>
+ </property>
+
Note: If you use framed transport, you cannot use doAs impersonation, because SASL does not work with Thrift framed transport.
-doAs Impersonation provides a flexible way to use the same client to impersonate multiple principals. doAs is supported only in Thrift 1.
-Enable doAs support by adding the following properties to hbase-site.xml on each Thrift gateway:
+### Kerberos cluster
+
+In a secure cluster its also needs these properties:
<property>
- <name>hbase.regionserver.thrift.http</name>
- <value>true</value>
+ <name>hbase.thrift.spnego.principal</name>
+ <value>HTTP/<hostname_from_above>@REALM</value>
+ <!-->Note, _HOST does not work. ## Can be found from CM-Administration->Security->Kerberos Credentials (HTTP/....)</!-->
</property>
<property>
- <name>hbase.thrift.support.proxyuser</name>
- <value>true/value>
+ <name>hbase.thrift.spnego.keytab.file</name>
+ <value>hbase.keytab/value>
</property>
+And from the HBase shell, authorize some ends users, e.g. to give full access to `admin`:
+
+ hbase shell> grant 'admin', 'RWXCA'
+
## Others
### Data Catalog
