HBase supports strong notions of security through integration with Kerberos. Kerberos is a widely deployed network authentication protocol. A detailed explanation of Kerberos is beyond the scope of this chapter.

An HBase cluster that supports Kerberos requires some additional setup steps. Kerberos works with the notion of principals and keytabs. A Kerberos principal is what identifies a client attempting to talk to HBase. A Kerberos keytab is a file that contains authentication keys (similar to a password). A client can authenticate itself by providing both its principal and keytab.

On a Kerberized cluster, the hbase-site.xml has the following additional entries:

<property> 
    <name>hbase.security.authentication</name> 
    <value>kerberos</value>  
</property>  
       
<property> 
    <name>hbase.security.authorization</name> 
    <value>true</value> 
</property> 

To interact with a secure HBase, the client application will need to ensure that the hbase-site.xml is included on its classpath.

In addition, the following API calls need to be invoked before creating a Connection object:

Configuration conf = HBaseConfiguration.create();

 UserGroupInformation.setConfiguration(conf);
 UserGroupInformation.loginUserFromKeytab(principal, keytabLocation);

 Connection conn = ConnectionFactory.createConnection(conf); 

The UserGroupInformation or UGI is the class that handles all of the Kerberos authentication in an HBase client application. In the loginUserFromKeytab() method, the client needs to provide the Kerberos principal name and the file location of the Kerberos keytab. Once the client is authenticated, it will create a Connection object to the cluster like it did before.