Skip to content

Starburst Enterprise 360 and later with PrivaceraCloud#

Starburst Enterprise is the commercially supported product based on open source Trino (previously PrestoSQL). It is used to process high-speed interactive SQL queries against data lake storage such as S3, and to create a data virtualization layer that federates queries across data lakes, relational databases and other sources.

PrivaceraCloud can provide system-wide access control across all data exposed in Starburst Enterprise.

Both privacera_hive and privacera_starburstenterprise resource policies can be used to integrate with both Starburst managed sources as well as 3rd party sources (such as Databricks) to maintain policy consistency.

Note

A common implementation pattern for data sources not directly supported in Privacera is to use Starburst Enterprise as a point of access policy enforcement. Create a layer of views in Starburst Enterprise on top of the unsupported source, apply Privacera access control policies to those views, and then limit most access to the source outside of Starburst Enterprise.

Starburst Enterprise is often deployed using a pre-built Docker image provided by Starburst. Using a Docker image for testing and single node deployment can be significantly faster than working with either RPM or "tarball" deployments. The instructions here describe the container-based deployment but other environments are similar. The following information explains how to configure Starburst Enterprise with port 8443 for TLS/HTTPS so that usernames/passwords are possible.

Note

PrivaceraCloud is a managed service so there is currently no option for connecting to a secured Starburst Enterprise instance that utilizes “self-signed” SSL certificates. The reason for this is because self signed certificates are not chained to a publicly authenticated root certificate authority (“ca-root”).

Prerequisites#

The following items need to be enabled/shared prior to deploying a Starburst Docker image:

  • A licensed version of Starburst.
  • Docker-ce 18+ must be installed.
  • JDK 11 to generate the Java keystore.
  • JDBC URL to connect to the Starburst Enterprise instance, including catalog and schema. Unless you specify a catalog name, the JDBC connection is validated only to the host level.
  • CA-signed SSL certificate for production deployment.
  • Your PrivaceraCloud API Key.

Configure Privacera Plugin with Starburst Enterprise#

Note

The Docker image already includes the Privacera plugin needed for policy enforcement. Your tasks will be to create or update a number of configuration files in the container.

Summary of steps:

  • Generate access-control file(s) for Starburst (required) and for Hive catalogs (optional).
  • Generate a Ranger Audit XML file.
  • Generate a Ranger SSL XML file.
  • Generate a PrivaceraCloud JCEKS file.

Generate access-control files#

To enable Privacera for authorization, you need to update the etc/config.properties file with one of the following entries:

    prop

    # privacera auth for hive and system access control
    access-control.config-files=/etc/starburst/access-control-privacera.properties,/etc/starburst/access-control-priv-hive.properties

Or

    prop

    # privacera auth for only system access control
    access-control.config-files=/etc/starburst/access-control-privacera.properties

Generate a Ranger Audit XML file#

The example below depends on your individual PrivaceraCloud API Key, which you must insert in three places below.

etc/ranger-hive-audit.xml

    <?xml version="1.0" encoding="UTF-8"?>
    <configuration>
    <property>
        <name>ranger.plugin.hive.service.name</name>
        <value>privacera_hive</value>
    </property>
    <property>
        <name>ranger.plugin.hive.policy.pollIntervalMs</name>
        <value>5000</value>
    </property>
    <property>
        <name>ranger.service.store.rest.url</name>
        <value>
    https://<YOUR_PRIVACERACLOUD_API_URL>/<API_KEY>
        </value>
    </property>

    <property>
        <name>ranger.plugin.hive.policy.rest.url</name>
        <value>
    https://<YOUR_PRIVACERACLOUD_API_URL>/<API_KEY>
        </value>
    </property>
    <property>
        <name>ranger.plugin.hive.policy.source.impl</name>
        <value>org.apache.ranger.admin.client.RangerAdminRESTClient</value>
        <description>
            Class to retrieve policies from the source
        </description>
    </property>
    <property>
        <name>ranger.plugin.hive.policy.rest.ssl.config.file</name>
    <value>/etc/starburst/ranger-policymgr-ssl.xml</value>
        <description>
            Path to the file containing SSL details to contact Ranger Admin
        </description>
    </property>
    <property>
        <name>ranger.service.store.rest.ssl.config.file</name>
    <value>/etc/starburst/ranger-policymgr-ssl.xml</value>
    </property>
    <property>
        <name>ranger.plugin.hive.policy.cache.dir</name>
    <value>/etc/starburst/tmp/ranger</value>
        <description>
            Directory where Ranger policies are cached after successful retrieval from the source
        </description>
    </property>
    <property>
        <name>ranger.plugin.starburst-enterprise-presto.policy.cache.dir</name>
    <value>/etc/starburst/tmp/ranger</value>
        <description>
                Directory where Ranger policies are cached after successful retrieval from the source
        </description>
    </property>
    <property>
        <name>xasecure.audit.destination.solr</name>
        <value>true</value>
    </property>
    <property>
        <name>xasecure.audit.destination.solr.batch.filespool.dir</name>
    <value>/etc/starburst/tmp/solr</value>
    </property>
    <property>
        <name>xasecure.audit.destination.solr.urls</name>
        <value>
    https://<YOUR_PRIVACERACLOUD_API_URL>/<API_KEY>/solr/ranger_audits
        </value>
    </property>
    <property>
        <name>xasecure.audit.is.enabled</name>
        <value>true</value>
    </property>
    <property>
        <name>xasecure.audit.solr.is.enabled</name>
        <value>true</value>
    </property>
    <property>
        <name>xasecure.audit.solr.async.max.queue.size</name>
        <value>1</value>
    </property>
    <property>
        <name>xasecure.audit.solr.async.max.flush.interval.ms</name>
        <value>1000</value>
    </property>
</configuration>

To install this file into the Docker container, you can add an option to your container creation script:

-v $DOCKER_HOME/$STARBURST_VERSION/etc/ranger-hive-audit.xml:$STARBURST_TGT/ranger-hive-audit.xml

Generate a Ranger SSL XML file#

The Ranger SSL XML file is needed when using PrivaceraCloud. This is because it uses API keys and the location of the JDK inside the Starburst containers might be different than other installations.

After the change from “starburst-presto” to “starburst-trino” releases, the JDK installation was updated by the Starburst engineering team.

Note

The <value> tags that follow should be verified periodically or based on best practices from Starburst engineering/partner teams.

etc/ranger-policymgr-ssl.xml

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <property>
    <name>xasecure.policymgr.clientssl.truststore</name>
    <value>/etc/pki/java/cacerts</value>
    </property>
    <property>
    <name>xasecure.policymgr.clientssl.truststore.password</name>
    <value>crypted</value>
    </property>
    <property>
    <name>xasecure.policymgr.clientssl.truststore.credential.file</name>
    <value>jceks://file/etc/starburst/privaceracloud.jceks</value>
    </property>
</configuration>

To install this file into the Docker container, you can add an option to your container creation script:

-v $DOCKER_HOME/$STARBURST_VERSION/etc/ranger-policymgr-ssl.xml:$STARBURST_TGT/ranger-polcymgr-ssl.xml

Generate a PrivaceraCloud JCEKS file#

Edit etc/privaceracloud.jceks.

This file is for an encrypted password for reading/accessing the Java CACerts inside the Starburst containers.

If you are generating a JCEKS with the default Java Truststore password (“changeit”), you can use an existing Hive Metastore environment or an Hadoop distribution that is running Java 8 or newer.

Example CLI:

hadoop credential create sslTrustStore -value changeit -provider localjceks://file/var/tmp/privaceracloud.jceks

To install this file into the Docker container, you can add an option to your container creation script:

-v $DOCKER_HOME/$STARBURST_VERSION/etc/privaceracloud.jceks:$STARBURST_TGT/privaceracloud.jceks

Connect Starburst Enterprise Application#

Use the following steps to connect Starburst Enterprise application to the PrivaceraCloud for access management.

  1. Login to the PrivaceraCloud.

  2. Go the Setting > Applications.

  3. In the Applications screen, select Starburst Enterprise.

  4. Enter the application Name and Description, and then click Save.

  5. Click the toggle button to enable the Access Management for Starburst Enterprise.

    The message displays, Save the setting to start controlling access on Starburst Enterprise.

  6. Click Save.


Last update: February 22, 2022