Prerequisites and limitations

Note

This document only lists basic requirements for deploying the User Isolation Framework. Individual components may have additional requirements. Please refer to the detailed capabilities and reference architectures sections for more details.

Prerequisites

Local machine

This setup is mandatory for all deployments of UIF.

• ACL support must be enabled on the filesystem which hosts the Agent Management data directory

• You need root access to setup the User Isolation Framework

For each UNIX user which will be impersonated by the Agent Management end-user (see concepts for more details), the following requirements must be met:

• The user must have a valid UNIX account.

• The user must have a valid shell (ie, must be able to perform shell actions).

Each group of users in Agent Management should have a matching UNIX group of users locally.

LDAP

While manual configuration of all user accounts is fully possible, we recommend that you use a LDAP directory to have a unique source of truth for all users and group mappings, in Agent Management, on UNIX, and on Hadoop.

Agent Management

Migrating a Agent Management instance which was previously running without UIF is highly not recommended. We highly recommend starting with an empty Agent Management instance when setting up UIF.

“Downgrading” a Agent Management instance by disabling UIF is not supported.

Required information

In addition to the above prerequisites, you need to gather some information.

You will need to obtain an initial list of UNIX groups that your end users belong to. Only users belonging to these groups will be allowed to use the impersonation mechanisms.

Limitations

Unsafe features

When UIF is enabled, the following features are not available for end-users unless they have the “Write unsafe code” permission:

• Write custom partition dependency functions

• Write Python UDF in data preparation

For more information about the “Write unsafe code” permission, see Write unisolated code: details