User creation methods, devices, user management systems, and storage media for Hadoop clusters

Abstract

This application provides a user creation method, apparatus, and user management system for a Hadoop cluster. The method includes: an authentication server obtaining user identity information and registering the user based on that information to obtain a user account, with each user account corresponding one-to-one with the identity information; the authentication server being any server in the Hadoop cluster that provides authentication services; the authentication server generating an authorization certificate based on the user account, with each authorization certificate bound to a user account; and the authorization certificate authorizing the user account to access servers in the Hadoop cluster; the authentication server storing the authorization certificate, enabling non-authentication servers to access the authentication server through a first SSSD process to query the user account's authorization certificate. These non-authentication servers are servers other than the authentication server in the Hadoop cluster. This method solves the problem of complex user creation operations in existing Hadoop cluster technologies.

Description

Technical Field

[0001] This invention relates to the field of user information management, and more specifically, to a user creation method, apparatus, computer-readable storage medium, and user management system for a Hadoop cluster. Background Technology

[0002] The default security mechanisms of Hadoop clusters have numerous vulnerabilities, allowing anonymous access and posing a significant risk of data leakage in production environments. Enabling Kerberos security requires authentication before accessing cluster data, granting access to restricted resources. However, adding new users to a Hadoop cluster with Kerberos enabled requires manual creation on each node. This becomes time-consuming and laborious when dealing with a large number of nodes, and users are prone to being missed, making troubleshooting difficult. Disabling users also requires disabling them node by node, leading to inconvenient management and low efficiency. Summary of the Invention

[0003] The main objective of this application is to provide a user creation method, apparatus, computer-readable storage medium, and user management system for a Hadoop cluster, so as to at least solve the problem of the complexity of user creation operations in the prior art for Hadoop clusters.

[0004] To achieve the above objectives, according to one aspect of this application, a user creation method for a Hadoop cluster is provided, comprising: an authentication server obtaining user identity information and registering the user account based on the identity information, wherein the user account corresponds one-to-one with the identity information, and the authentication server is any server in the Hadoop cluster that provides authentication services; the authentication server generating an authorization certificate based on the user account, wherein the authorization certificate is bound one-to-one with the user account, and the authorization certificate is a certificate authorizing the user account to access servers in the Hadoop cluster; the authentication server storing the authorization certificate, enabling a non-authentication server to access the authentication server through a first SSSD process to query the authorization certificate of the user account, wherein the non-authentication server is a server other than the authentication server in the Hadoop cluster.

[0005] Optionally, the authentication server stores the authorization certificate, enabling non-authentication servers to access the authentication server through a first SSSD process to query the authorization certificate of the user account. This includes: when all servers in the Hadoop cluster have SSSD tools installed, the authentication server accepts an access request from the first SSSD process of the non-authentication server, the access request being used to query whether the authentication server stores the authorization certificate of the user account.

[0006] Optionally, after the authentication server saves the authorization certificate, the method further includes: if all servers in the Hadoop cluster have SSSD tools installed and the authentication server locks the authorization certificate, prohibiting the non-authentication server from calling the second SSSD process to access the authentication server to query the authorization certificate of the user account, so as to prevent the servers in the Hadoop cluster from authorizing access to the user account.

[0007] Optionally, the authentication server obtains the user's identity information by: the authentication server receiving an access request from a third SSSD process, the access request being sent by any client connected to the third SSSD process, and the access request including the identity information.

[0008] Optionally, the authentication server stores the authorization certificate by: the authentication server calling the third SSSD process to cache the authorization certificate.

[0009] Optionally, the authentication server obtains the user's identity information and registers the user account based on the identity information, including: the authentication server calling an API interface to receive the identity information input by the client; and the authentication server registering the user account based on the identity information.

[0010] Optionally, the authentication server generates an authorization certificate based on the user account, including: the authentication server calling the LDAP authentication service to generate an authorization certificate corresponding to the user account.

[0011] According to another aspect of this application, a user creation apparatus for a Hadoop cluster is provided, comprising: a first processing unit, configured to have an authentication server obtain user identity information and register the user account based on the identity information, wherein the user account corresponds one-to-one with the identity information, and the authentication server is any server in the Hadoop cluster that provides authentication services; a generation unit, configured to have the authentication server generate an authorization certificate based on the user account, wherein the authorization certificate is bound one-to-one with the user account, and the authorization certificate is a certificate authorizing the user account to access servers in the Hadoop cluster; and a second processing unit, configured to have the authentication server store the authorization certificate, enabling a non-authentication server to access the authentication server through a first SSSD process to query the authorization certificate of the user account, wherein the non-authentication server is a server other than the authentication server in the Hadoop cluster.

[0012] According to another aspect of this application, a computer-readable storage medium is provided, the computer-readable storage medium including a stored program, wherein, when the program is executed, it controls the device on which the computer-readable storage medium is located to perform any of the methods described.

[0013] According to another aspect of this application, a processor is provided for running a program that, when running, performs any of the methods described.

[0014] According to another aspect of this application, a user management system for a Hadoop cluster is provided, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs including methods for performing any one of the methods described.

[0015] Applying the technical solution of this application, firstly, the authentication server obtains the user's identity information and registers the user account based on the identity information. The user account corresponds one-to-one with the identity information, and the authentication server can be any server in the Hadoop cluster that provides authentication services. Then, the authentication server generates an authorization certificate based on the user account. The authorization certificate is bound one-to-one with the user account and authorizes the user account to access the servers in the Hadoop cluster. Finally, the authentication server saves the authorization certificate, allowing non-authentication servers to access the authentication server through the first SSSD process to query the authorization certificate for the user account. These non-authentication servers are servers other than the authentication server in the Hadoop cluster. This method creates users, generates user accounts and corresponding authorization certificates, and saves the authorization certificates through the authentication server in the Hadoop cluster. This allows non-authentication servers to access the authentication server through the first SSSD process to query the authorization certificate for the user account, enabling all servers in the Hadoop cluster to authorize user account access without creating users on each server in the Hadoop cluster. This solves the problem of complex user creation operations in existing technologies for Hadoop clusters. Attached Figure Description

[0016] Figure 1 A hardware structure block diagram of a mobile terminal for executing a user creation method for a Hadoop cluster, according to an embodiment of this application, is shown.

[0017] Figure 2 A flowchart illustrating a user creation method for a Hadoop cluster according to an embodiment of this application is shown.

[0018] Figure 3 A flowchart illustrating a specific embodiment of a user creation method for a Hadoop cluster provided according to an embodiment of this application is shown;

[0019] Figure 4 A structural block diagram of a user creation apparatus for a Hadoop cluster provided according to an embodiment of this application is shown. Detailed Implementation

[0020] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0021] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0022] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this application described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0023] For ease of description, the following explains some of the nouns or terms used in the embodiments of this application:

[0024] LDAP: Lightweight Directory Access Protocol is an open, neutral, industry-standard application protocol that provides access control and maintains distributed directory information via the IP protocol.

[0025] TLS: Transport Layer Security, a protocol that provides security and data integrity for internet communications. Its predecessor, Secure Sockets Layer (SSL), was a security protocol designed to ensure the security of internet communications.

[0026] CA Certificate: Certificate Authority. A CA is a certificate issuing authority and is the core of Public Key Infrastructure (PKI). A CA is responsible for issuing, authenticating, and managing issued certificates. CA certificates include information about the electronic issuing authority, public key user information, the public key, the authority's signature, and the validity period, etc. Certificate formats and verification methods generally follow the X.509 international standard.

[0027] SSSD (System Security Services Dameon) enables remote naming services and remote authentication on Linux. It's a daemon process that can access various authentication servers, such as LDAP and Kerberos, and provide authorization. SSSD acts as an intermediary between the local user and data storage; the local client first connects to SSSD, which then contacts the external resource provider (a remote server).

[0028] Kerberos: Kerberos is a computer network authorization protocol used to securely authenticate personal communications in insecure networks.

[0029] Hadoop: Hadoop is a distributed system infrastructure developed by the Apache Software Foundation. Users can develop distributed programs without understanding the underlying details of distributed systems, fully leveraging the power of clusters for high-speed computation and storage.

[0030] As described in the background section, adding new users to a Kerberos-secured Hadoop cluster in the prior art is cumbersome, requiring logging into all nodes to configure the same user. To address the complexity of user creation in the prior art for Hadoop clusters, embodiments of this application provide a user creation method, apparatus, computer-readable storage medium, and user management system for a Hadoop cluster.

[0031] The technical solutions in the embodiments of the present invention will be described clearly and completely below with reference to the accompanying drawings in the embodiments of the present invention.

[0032] The methods and embodiments provided in this application can be executed on a mobile terminal, a computer terminal, or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 This is a hardware structure block diagram of a mobile terminal for a user creation method of a Hadoop cluster according to an embodiment of the present invention. Figure 1 As shown, a mobile terminal may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data are also shown. The mobile terminal may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the mobile terminal described above. For example, the mobile terminal may also include components that are more... Figure 1 The more or fewer components shown, or having the same Figure 1The different configurations shown.

[0033] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the device information display method in this embodiment of the invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, thereby implementing the above-described method. The memory 104 may include high-speed random access memory and non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of the aforementioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. The transmission device 106 is used to receive or send data via a network. Specific examples of the aforementioned networks may include wireless networks provided by the mobile terminal's communication provider. In one example, the transmission device 106 includes a network interface controller (NIC), which can be connected to other network devices via a base station to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0034] This embodiment provides a user creation method for a Hadoop cluster running on a mobile terminal, computer terminal, or similar computing device. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Also, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0035] Figure 2 This is a flowchart of a user creation method for a Hadoop cluster according to an embodiment of this application. Figure 2 As shown, the method includes the following steps:

[0036] Step S201: The authentication server obtains the user's identity information and registers the user account based on the identity information. The user account corresponds one-to-one with the identity information. The authentication server is any server in the Hadoop cluster that provides authentication services.

[0037] Specifically, this application uses LDAP to manage user information, requiring the configuration of LDAP service on the aforementioned authentication server. First, install LDAP tools such as openldap-servers, openldap-clients, and openldap. Then, customize the configuration file, specifying the location of the user identity information file and creating a corresponding entry for each user identity information stored on the server. Each entry must define the object class, provide attribute values ​​for required attribute types in the object class, specify the TLS file location, and allow switching of the TLS file storage directory to provide security and data integrity guarantees for communication. Finally, verify that the file path configuration is correct and start the LDAP service. Since LDAP supports query operations, the authentication server can query user identity information through LDAP and register accounts based on the queried user identity information, resulting in one account for each user identity information. Therefore, each identity information corresponds to one user account. In addition, LDAP also supports update, authentication, and control operations. Therefore, when managing users in the aforementioned Hadoop cluster, users can be directly managed by logging into the server backend and executing commands.

[0038] In step S202, the authentication server generates an authorization certificate based on the user account. The authorization certificate is bound to the user account in a one-to-one correspondence. The authorization certificate is a certificate that authorizes the user account to access the server of the Hadoop cluster.

[0039] Specifically, because the authorization certificate is generated based on the user information corresponding to the aforementioned user account, each user account has a corresponding authorization certificate bound to it. The aforementioned authorization certificate is a CA certificate, and the content of a CA certificate includes information about the electronic visa authority, public key user information, the public key, the signature of the authoritative authority, and the validity period, etc. The certificate format and verification methods generally follow the X.509 international standard.

[0040] In step S203, the authentication server stores the authorization certificate, enabling non-authentication servers to access the authentication server through the first SSSD process to query the authorization certificate of the user account. The non-authentication server is a server other than the authentication server in the Hadoop cluster.

[0041] Specifically, the addition and deletion of users on the aforementioned authentication server can be implemented across the entire Hadoop cluster, with an operation synchronized across the entire cluster. By installing the SSSD tool on each server node within the cluster, the SSSD process can access the authentication server to query the authorization certificates for the aforementioned user accounts, eliminating the need to create users individually on each server within the Hadoop cluster.

[0042] Applying the technical solution of this application, firstly, the authentication server obtains the user's identity information and registers the user account based on the identity information. The user account corresponds one-to-one with the identity information, and the authentication server can be any server in the Hadoop cluster that provides authentication services. Then, the authentication server generates an authorization certificate based on the user account. The authorization certificate is bound one-to-one with the user account and authorizes the user account to access the servers in the Hadoop cluster. Finally, the authentication server saves the authorization certificate, allowing non-authentication servers to access the authentication server through the first SSSD process to query the authorization certificate for the user account. These non-authentication servers are servers other than the authentication server in the Hadoop cluster. This method creates users, generates user accounts and corresponding authorization certificates, and saves the authorization certificates through the authentication server in the Hadoop cluster. This allows non-authentication servers to access the authentication server through the first SSSD process to query the authorization certificate for the user account, enabling all servers in the Hadoop cluster to authorize user account access without creating users on each server in the Hadoop cluster. This solves the problem of complex user creation operations in existing technologies for Hadoop clusters.

[0043] To reduce the load on the authentication server, in one optional implementation, step S201 specifically includes:

[0044] In step S2011, the authentication server receives an access request from the third SSSD process. The access request is sent by any client connected to the third SSSD process and includes the identity information.

[0045] Specifically, since SSSD is a process situated between the local user and the server's data storage, the local client first connects to the SSSD process, and then the SSSD process connects to the server. When the client needs to obtain user identity information, the third-party SSSD process sends an access request to the authentication server and then collects the user identity information stored in the authentication server. This implementation avoids a large number of connections between the client and the authentication server, reducing the load on the authentication server.

[0046] To reduce the difficulty for operators in performing dynamic maintenance of cluster users, in one optional implementation, step S201 specifically includes:

[0047] In step S2012, the authentication server calls the API interface to receive the identity information input by the client.

[0048] Specifically, this application supports an API interface, which can be integrated into the management interface via API calls to achieve page-based operations. After the client enters the aforementioned identity information in the management interface, the authentication server can directly obtain the identity information from the page. Using this implementation method, operators do not need to understand the underlying implementation to complete the dynamic maintenance of cluster users, reducing the complexity.

[0049] In step S2013, the authentication server registers the user account based on the aforementioned identity information.

[0050] Specifically, after obtaining the identity information in step S2012, the user account registration can be completed based on the obtained identity information.

[0051] To automate the authorization of certificates, in one optional implementation, step S202 specifically includes:

[0052] In step S2021, the authentication server calls the LDAP authentication service to generate the authorization certificate corresponding to the user account.

[0053] Specifically, step S201 above completes the configuration of the LDAP service. Since LDAP supports authentication operations, the authentication server can configure the CA public key file path, the CA-issued certificate file path, and the local private key file path through LDAP. Then, it generates the local private key file according to the file path corresponding to the account, creates a certificate issuance request, generates public and private keys, sets a self-signature, generates the CA public key, and issues a certificate. Access authorization is achieved through identity authentication using the authorized certificate, i.e., the CA certificate.

[0054] To synchronize operations on one server node to the entire cluster, in one optional implementation, step S203 specifically includes:

[0055] Step S2031: If all servers in the Hadoop cluster have SSSD installed, the authentication server accepts the access request from the first SSSD process of the non-authentication server. The access request is used to query whether the authentication server has stored the authorization certificate of the user account.

[0056] Specifically, the SSSD process enables remote naming services and remote authentication functions in Linux. This process can be used to access various authentication servers. Step S203 above completes the installation of the SSSD tool on each server node, and then the SSSD paper document is customized. After that, the authorization certificate generated by the authentication server is used. The authentication server accepts the access request from the first SSSD process of the non-authentication server, and can query whether the authentication server has stored the authorization certificate of the user account. Finally, the SSSD service is started to verify that each server node has obtained the LDAP user information. If the user information is correct, the user account can be authorized to access.

[0057] In addition, the above method can also be used to configure a server node in a Hadoop cluster to establish mutual trust and passwordless login with other nodes. Then, a shell script can be written on the above node to synchronously add new users to all nodes. The above user addition operation can only be performed manually with the root administrator privileges of the operating system.

[0058] To reduce the workload of administrators when managing users of the Hadoop cluster, in an optional implementation, after step S203, the method further includes:

[0059] Step S301: If all servers in the Hadoop cluster have the SSSD tool installed and the authentication server has locked the authorization certificate, the non-authentication server is prohibited from calling the second SSSD process to access the authentication server to query the authorization certificate of the user account, so as to prevent the servers in the Hadoop cluster from authorizing access to the user account.

[0060] Specifically, the SSSD process enables remote naming services and remote authentication in Linux. This process can access various authentication servers. With all server nodes configured with the SSSD process, when an authentication server locks the authorization certificate for a specific account, prohibiting that user from accessing the system, the non-authentication servers are also prohibited from calling the second SSSD process to access the authentication server to query the authorization certificate for that user account. This simultaneously prohibits the user's access, thus effectively blocking access to that user across the entire Hadoop cluster. Using this implementation, administrators only need to modify the authorization status of one node to change the authorization status of the entire Hadoop cluster, significantly reducing their workload.

[0061] To ensure that user management of the Hadoop cluster continues to function normally even when the authentication server fails, in one optional implementation, step S203 further includes:

[0062] In step S2032, the authentication server calls the third SSSD process to cache the authorization certificate.

[0063] Specifically, SSSD can cache user authentication credentials on remote servers, allowing the Hadoop cluster to continue successfully authorizing user access even when the remote authentication server fails. Therefore, this application configures the LDAP service on two authentication servers simultaneously. One authentication server serves as the primary authentication server, and when the primary authentication server fails, the other authentication server acts as a backup, retrieving the authorization certificate cached in the SSSD process to ensure continued user authorization within the Hadoop cluster.

[0064] To enable those skilled in the art to better understand the technical solution of this application, the implementation process of the user creation method for the Hadoop cluster of this application will be described in detail below with reference to specific embodiments.

[0065] This embodiment relates to a specific method for creating users for a Hadoop cluster, such as... Figure 3 As shown, it includes the following steps:

[0066] Step S1: Install the LDAP tool on both servers;

[0067] Step S2: Modify the LDAP configuration file on the server, specify the location of the TLS file, allow switching the TLS file storage directory, and specify the location of the user information file;

[0068] Step S3: Modify the LDAP configuration file on the server to configure the path to the CA public key file, the path to the certificate file issued by the CA, and the path to the local private key file;

[0069] Step S4: Generate a local private key file, create a certificate issuance request, generate public and private keys, set a self-signature, generate a CA public key, and issue a certificate;

[0070] Step S5: Check and confirm that the CA certificate and public / private key file paths are configured correctly, and then start the LDAP service;

[0071] Step S6: Install the SSSD tool on all nodes in the cluster;

[0072] Step S7: Any node within the group accesses the LDAP server via the SSSD process to query the CA certificate;

[0073] Step S8: Integrate user management functions into the management page via API calls;

[0074] Step S9: Directly manage cluster users through the LDAP or API management page.

[0075] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0076] This application also provides a user creation apparatus for a Hadoop cluster. It should be noted that this Hadoop cluster user creation apparatus can be used to execute the user creation method for a Hadoop cluster provided in this application. This apparatus is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can refer to a combination of software and / or hardware that implements a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0077] The following describes the user creation device for the Hadoop cluster provided in the embodiments of this application.

[0078] Figure 4 This is a schematic diagram of a user creation device for a Hadoop cluster according to an embodiment of this application. Figure 4 As shown, the device includes:

[0079] The first processing unit 10 is used for the authentication server to obtain the user's identity information and register according to the identity information to obtain a user account. The user account corresponds one-to-one with the identity information. The authentication server is any server in the Hadoop cluster that provides authentication services.

[0080] Specifically, this application uses LDAP to manage user information, requiring the configuration of LDAP service on the aforementioned authentication server. First, install LDAP tools such as openldap-servers, openldap-clients, and openldap. Then, customize the configuration file, specifying the location of the user identity information file and creating a corresponding entry for each user identity information stored on the server. Each entry must define the object class, provide attribute values ​​for required attribute types in the object class, specify the TLS file location, and allow switching of the TLS file storage directory to provide security and data integrity guarantees for communication. Finally, verify that the file path configuration is correct and start the LDAP service. Since LDAP supports query operations, the authentication server can query user identity information through LDAP and register accounts based on the queried user identity information, resulting in one account for each user identity information. Therefore, each identity information corresponds to one user account. In addition, LDAP also supports update, authentication, and control operations. Therefore, when managing users in the aforementioned Hadoop cluster, users can be directly managed by logging into the server backend and executing commands.

[0081] The generation unit 20 is used by the authentication server to generate an authorization certificate based on the user account. The authorization certificate is bound to the user account in a one-to-one correspondence. The authorization certificate is a certificate that authorizes the user account to access the server of the Hadoop cluster.

[0082] Specifically, because the authorization certificate is generated based on the user information corresponding to the aforementioned user account, each user account has a corresponding authorization certificate bound to it. The aforementioned authorization certificate is a CA certificate, and the content of a CA certificate includes information about the electronic visa authority, public key user information, the public key, the signature of the authoritative authority, and the validity period, etc. The certificate format and verification methods generally follow the X.509 international standard.

[0083] The second processing unit 30 is used to store the authorization certificate on the authentication server, so that a non-authentication server can access the authentication server through the first SSSD process to query the authorization certificate of the user account. The non-authentication server is a server other than the authentication server in the Hadoop cluster.

[0084] Specifically, the addition and deletion of users on the aforementioned authentication server can be implemented across the entire Hadoop cluster, with an operation synchronized across the entire cluster. By installing the SSSD tool on each server node within the cluster, the SSSD process can access the authentication server to query the authorization certificates for the aforementioned user accounts, eliminating the need to create users individually on each server within the Hadoop cluster.

[0085] Applying the technical solution of this application, the first processing unit is used by the authentication server to obtain the user's identity information and register according to the identity information to obtain a user account. The user account corresponds one-to-one with the identity information, and the authentication server is any server in the Hadoop cluster that provides authentication services. The generation unit is used by the authentication server to generate an authorization certificate according to the user account. The authorization certificate is bound one-to-one with the user account, and the authorization certificate is a certificate that authorizes the user account to access the servers in the Hadoop cluster. The second processing unit is used by the authentication server to save the authorization certificate, so that non-authentication servers can access the authentication server through the first SSSD process to query the authorization certificate of the user account. The non-authentication servers are servers other than the authentication server in the Hadoop cluster. This device creates users, generates user accounts and corresponding authorization certificates, and saves the authorization certificates through the authentication server in the Hadoop cluster. It allows non-authentication servers to access the authentication server through the first SSSD process to query the authorization certificate of the user account, thereby enabling all servers in the Hadoop cluster to authorize user account access without having to create users one by one on each server in the Hadoop cluster, solving the problem of complex user creation operations in the prior art for Hadoop clusters.

[0086] To reduce the load on the authentication server, in one optional implementation, the first processing unit includes:

[0087] The receiving module is used for the authentication server to receive access requests from the third SSSD process, wherein the access request is sent by any client connected to the third SSSD process, and the access request includes the aforementioned identity information.

[0088] Specifically, since SSSD is a process situated between the local user and the server's data storage, the local client first connects to the SSSD process, and then the SSSD process connects to the server. When the client needs to obtain user identity information, the third-party SSSD process sends an access request to the authentication server and then collects the user identity information stored in the authentication server. This implementation avoids a large number of connections between the client and the authentication server, reducing the load on the authentication server.

[0089] To reduce the difficulty for operators in performing dynamic maintenance of cluster users, in one optional implementation, the first processing unit includes:

[0090] The acquisition module is used by the authentication server to call the API interface to receive the aforementioned identity information input by the client.

[0091] Specifically, this application supports an API interface, which can be integrated into the management interface via API calls to achieve page-based operations. After the client enters the aforementioned identity information in the management interface, the authentication server can directly obtain the identity information from the page. Using this implementation method, operators do not need to understand the underlying implementation to complete the dynamic maintenance of cluster users, reducing the complexity.

[0092] The first processing module is used by the authentication server to register the user account based on the identity information.

[0093] Specifically, after obtaining the identity information, the aforementioned acquisition module can complete the registration of the user account based on the obtained identity information.

[0094] To automate the authorization process, in one optional implementation, the generation unit specifically includes:

[0095] The second processing module is used by the authentication server to call the LDAP authentication service to generate the authorization certificate corresponding to the user account.

[0096] Specifically, the first processing unit described above completes the configuration of the LDAP service. Since LDAP supports authentication operations, the authentication server can configure the CA public key file path, the CA-issued certificate file path, and the local private key file path through LDAP. Then, it generates a local private key file based on the file path corresponding to the account, creates a certificate issuance request, generates public and private keys, sets a self-signature, generates a CA public key, and issues a certificate. Access authorization is achieved through identity authentication using the authorized certificate, i.e., the CA certificate.

[0097] To synchronize operations on one server node to the entire cluster, in one optional implementation, the second processing unit includes:

[0098] The third processing module is used to, when all servers in the Hadoop cluster have SSSD installed, allow the authentication server to accept access requests from the first SSSD process of the non-authentication server. The access requests are used to query whether the authentication server has stored the authorization certificate of the user account.

[0099] Specifically, the SSSD process enables remote naming services and remote authentication on Linux. This process can access various authentication servers, install the SSSD tool on each server node, and then customize the SSSD paper documents. Next, the authentication server, upon receiving access requests from the first SSSD process on the non-authentication server, will use the authorization certificate generated by the authentication server to check whether it holds the authorization certificate for the user account. Finally, the SSSD service is started to verify the user information obtained by each server node from LDAP. If the user information is correct, access to the user account is authorized.

[0100] To reduce the workload of administrators when managing users of a Hadoop cluster, in one optional implementation, the above-mentioned apparatus further includes:

[0101] The third processing unit is used to prevent non-authentication servers from calling the second SSSD process to access the authentication server to query the authorization certificate of the user account after the authentication server saves the authorization certificate, provided that all servers in the Hadoop cluster have SSSD tools installed and the authentication server has locked the authorization certificate, so as to prevent the servers in the Hadoop cluster from authorizing access to the user account.

[0102] Specifically, the SSSD process enables remote naming services and remote authentication on Linux. This process can access various authentication servers. Assuming all server nodes have configured the SSSD process, when an authentication server locks the authorization certificate for a specific account, prohibiting that user from accessing the Hadoop cluster, the aforementioned second SSSD process accesses all other server nodes in the Hadoop cluster, synchronously changing the authorization status of the current user's certificate on those other server nodes, thus simultaneously prohibiting the user's access and ultimately blocking access to that user across the entire Hadoop cluster. Using this implementation method, administrators only need to modify the authorization status of one node to change the authorization status of the entire Hadoop cluster, significantly reducing the workload for administrators.

[0103] To ensure that user management of the Hadoop cluster continues to function normally even when the authentication server fails, in one optional implementation, the second processing unit further includes:

[0104] The caching module is used by the authentication server to call the third SSSD process to cache the authorization certificate.

[0105] Specifically, SSSD can cache user authentication credentials on remote servers, allowing the Hadoop cluster to continue successfully authorizing user access even when the remote authentication server fails. Therefore, this application configures the LDAP service on two authentication servers simultaneously. One authentication server serves as the primary authentication server, and when the primary authentication server fails, the other authentication server acts as a backup, retrieving the authorization certificate cached in the SSSD process to ensure continued user authorization within the Hadoop cluster.

[0106] The user creation device for the aforementioned Hadoop cluster includes a processor and memory. The first processing unit, generation unit, and second processing unit are all stored as program units in the memory, and the processor executes these program units stored in the memory to implement the corresponding functions. All of the above modules reside in the same processor; alternatively, the modules may be located in different processors in any combination.

[0107] The processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and adjusting kernel parameters can simplify the user creation process for a Hadoop cluster.

[0108] The memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0109] This invention provides a computer-readable storage medium that includes a stored program, wherein, when the program is executed, it controls the device where the computer-readable storage medium is located to execute the user creation method of the Hadoop cluster.

[0110] Specifically, the methods for creating users of a Hadoop cluster include:

[0111] Step S201: The authentication server obtains the user's identity information and registers the user account based on the identity information. The user account corresponds one-to-one with the identity information. The authentication server is any server in the Hadoop cluster that provides authentication services.

[0112] Specifically, this application uses LDAP to manage user information, requiring the configuration of LDAP service on the aforementioned authentication server. First, install LDAP tools such as openldap-servers, openldap-clients, and openldap. Then, customize the configuration file, specifying the location of the user identity information file and creating a corresponding entry for each user identity information stored on the server. Each entry must define the object class, provide attribute values ​​for required attribute types in the object class, specify the TLS file location, and allow switching of the TLS file storage directory to provide security and data integrity guarantees for communication. Finally, verify that the file path configuration is correct and start the LDAP service. Since LDAP supports query operations, the authentication server can query user identity information through LDAP and register accounts based on the queried user identity information, resulting in one account for each user identity information. Therefore, each identity information corresponds to one user account. In addition, LDAP also supports update, authentication, and control operations. Therefore, when managing users in the aforementioned Hadoop cluster, users can be directly managed by logging into the server backend and executing commands.

[0113] In step S202, the authentication server generates an authorization certificate based on the user account. The authorization certificate is bound to the user account in a one-to-one correspondence. The authorization certificate is a certificate that authorizes the user account to access the server of the Hadoop cluster.

[0114] Specifically, because the authorization certificate is generated based on the user information corresponding to the aforementioned user account, each user account has a corresponding authorization certificate bound to it. The aforementioned authorization certificate is a CA certificate, and the content of a CA certificate includes information about the electronic visa authority, public key user information, the public key, the signature of the authoritative authority, and the validity period, etc. The certificate format and verification methods generally follow the X.509 international standard.

[0115] In step S203, the authentication server stores the authorization certificate, enabling non-authentication servers to access the authentication server through the first SSSD process to query the authorization certificate of the user account. The non-authentication server is a server other than the authentication server in the Hadoop cluster.

[0116] Specifically, the addition and deletion of users on the aforementioned authentication server can be implemented across the entire Hadoop cluster, with an operation synchronized across the entire cluster. By installing the SSSD tool on each server node within the cluster, the SSSD process can access the authentication server to query the authorization certificates for the aforementioned user accounts, eliminating the need to create users individually on each server within the Hadoop cluster.

[0117] Optionally, in step S2011, the authentication server receives an access request from the third SSSD process, the access request being sent by any client connected to the third SSSD process, and the access request including the aforementioned identity information.

[0118] Optionally, in step S2012, the authentication server calls the API interface to receive the identity information input by the client; in step S2013, the authentication server registers based on the identity information to obtain the user account.

[0119] Optionally, in step S2021, the authentication server calls the LDAP authentication service to generate the authorization certificate corresponding to the user account.

[0120] Optionally, in step S2031, if all servers in the Hadoop cluster have SSSD installed, the authentication server accepts the access request from the first SSSD process of the non-authentication server. The access request is used to query whether the authentication server has stored the authorization certificate of the user account.

[0121] Optionally, in step S301, if all servers in the Hadoop cluster have the SSSD tool installed and the authentication server has locked the authorization certificate, the non-authentication server is prohibited from calling the second SSSD process to access the authentication server to query the authorization certificate of the user account, so as to prevent the servers in the Hadoop cluster from authorizing access to the user account.

[0122] Optionally, in step S2032, the authentication server calls the third SSSD process to cache the authorization certificate.

[0123] This invention provides a processor for running a program, wherein the program executes the user creation method of the Hadoop cluster.

[0124] Specifically, the methods for creating users of a Hadoop cluster include:

[0125] Step S201: The authentication server obtains the user's identity information and registers the user account based on the identity information. The user account corresponds one-to-one with the identity information. The authentication server is any server in the Hadoop cluster that provides authentication services.

[0126] Specifically, this application uses LDAP to manage user information, requiring the configuration of LDAP service on the aforementioned authentication server. First, install LDAP tools such as openldap-servers, openldap-clients, and openldap. Then, customize the configuration file, specifying the location of the user identity information file and creating a corresponding entry for each user identity information stored on the server. Each entry must define the object class, provide attribute values ​​for required attribute types in the object class, specify the TLS file location, and allow switching of the TLS file storage directory to provide security and data integrity guarantees for communication. Finally, verify that the file path configuration is correct and start the LDAP service. Since LDAP supports query operations, the authentication server can query user identity information through LDAP and register accounts based on the queried user identity information, resulting in one account for each user identity information. Therefore, each identity information corresponds to one user account. In addition, LDAP also supports update, authentication, and control operations. Therefore, when managing users in the aforementioned Hadoop cluster, users can be directly managed by logging into the server backend and executing commands.

[0127] In step S202, the authentication server generates an authorization certificate based on the user account. The authorization certificate is bound to the user account in a one-to-one correspondence. The authorization certificate is a certificate that authorizes the user account to access the server of the Hadoop cluster.

[0128] Specifically, because the authorization certificate is generated based on the user information corresponding to the aforementioned user account, each user account has a corresponding authorization certificate bound to it. The aforementioned authorization certificate is a CA certificate, and the content of a CA certificate includes information about the electronic visa authority, public key user information, the public key, the signature of the authoritative authority, and the validity period, etc. The certificate format and verification methods generally follow the X.509 international standard.

[0129] In step S203, the authentication server stores the authorization certificate, enabling non-authentication servers to access the authentication server through the first SSSD process to query the authorization certificate of the user account. The non-authentication server is a server other than the authentication server in the Hadoop cluster.

[0130] Specifically, the addition and deletion of users on the aforementioned authentication server can be implemented across the entire Hadoop cluster, with an operation synchronized across the entire cluster. By installing the SSSD tool on each server node within the cluster, the SSSD process can access the authentication server to query the authorization certificates for the aforementioned user accounts, eliminating the need to create users individually on each server within the Hadoop cluster.

[0131] Optionally, in step S2011, the authentication server receives an access request from the third SSSD process, the access request being sent by any client connected to the third SSSD process, and the access request including the aforementioned identity information.

[0132] Optionally, in step S2012, the authentication server calls the API interface to receive the identity information input by the client; in step S2013, the authentication server registers based on the identity information to obtain the user account.

[0133] Optionally, in step S2021, the authentication server calls the LDAP authentication service to generate the authorization certificate corresponding to the user account.

[0134] Optionally, in step S2031, if all servers in the Hadoop cluster have SSSD installed, the authentication server accepts the access request from the first SSSD process of the non-authentication server. The access request is used to query whether the authentication server has stored the authorization certificate of the user account.

[0135] Optionally, in step S301, if all servers in the Hadoop cluster have the SSSD tool installed and the authentication server has locked the authorization certificate, the non-authentication server is prohibited from calling the second SSSD process to access the authentication server to query the authorization certificate of the user account, so as to prevent the servers in the Hadoop cluster from authorizing access to the user account.

[0136] Optionally, in step S2032, the authentication server calls the third SSSD process to cache the authorization certificate.

[0137] This invention provides a user management system for a Hadoop cluster. The user management system includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, it performs at least the following steps:

[0138] Step S201: The authentication server obtains the user's identity information and registers the user account based on the identity information. The user account corresponds one-to-one with the identity information. The authentication server is any server in the Hadoop cluster that provides authentication services.

[0139] In step S202, the authentication server generates an authorization certificate based on the user account. The authorization certificate is bound to the user account in a one-to-one correspondence. The authorization certificate is a certificate that authorizes the user account to access the server of the Hadoop cluster.

[0140] In step S203, the authentication server stores the authorization certificate, enabling non-authentication servers to access the authentication server through the first SSSD process to query the authorization certificate of the user account. The non-authentication server is a server other than the authentication server in the Hadoop cluster.

[0141] The devices mentioned in this article can be servers, PCs, tablets, mobile phones, etc.

[0142] Optionally, in step S2011, the authentication server receives an access request from the third SSSD process, the access request being sent by any client connected to the third SSSD process, and the access request including the aforementioned identity information.

[0143] Optionally, in step S2012, the authentication server calls the API interface to receive the identity information input by the client; in step S2013, the authentication server registers based on the identity information to obtain the user account.

[0144] Optionally, in step S2021, the authentication server calls the LDAP authentication service to generate the authorization certificate corresponding to the user account.

[0145] Optionally, in step S2031, if all servers in the Hadoop cluster have SSSD installed, the authentication server accepts the access request from the first SSSD process of the non-authentication server. The access request is used to query whether the authentication server has stored the authorization certificate of the user account.

[0146] Optionally, in step S301, if all servers in the Hadoop cluster have the SSSD tool installed and the authentication server has locked the authorization certificate, the non-authentication server is prohibited from calling the second SSSD process to access the authentication server to query the authorization certificate of the user account, so as to prevent the servers in the Hadoop cluster from authorizing access to the user account.

[0147] Optionally, in step S2032, the authentication server calls the third SSSD process to cache the authorization certificate.

[0148] This application also provides a computer program product, which, when executed on a data processing device, is suitable for executing an initialization program having at least the following method steps:

[0149] Step S201: The authentication server obtains the user's identity information and registers the user account based on the identity information. The user account corresponds one-to-one with the identity information. The authentication server is any server in the Hadoop cluster that provides authentication services.

[0150] In step S202, the authentication server generates an authorization certificate based on the user account. The authorization certificate is bound to the user account in a one-to-one correspondence. The authorization certificate is a certificate that authorizes the user account to access the server of the Hadoop cluster.

[0151] In step S203, the authentication server stores the authorization certificate, enabling non-authentication servers to access the authentication server through the first SSSD process to query the authorization certificate of the user account. The non-authentication server is a server other than the authentication server in the Hadoop cluster.

[0152] Optionally, in step S2011, the authentication server receives an access request from the third SSSD process, the access request being sent by any client connected to the third SSSD process, and the access request including the aforementioned identity information.

[0153] Optionally, in step S2012, the authentication server calls the API interface to receive the identity information input by the client; in step S2013, the authentication server registers based on the identity information to obtain the user account.

[0154] Optionally, in step S2021, the authentication server calls the LDAP authentication service to generate the authorization certificate corresponding to the user account.

[0155] Optionally, in step S2031, if all servers in the Hadoop cluster have SSSD installed, the authentication server accepts the access request from the first SSSD process of the non-authentication server. The access request is used to query whether the authentication server has stored the authorization certificate of the user account.

[0156] Optionally, in step S301, if all servers in the Hadoop cluster have the SSSD tool installed and the authentication server has locked the authorization certificate, the non-authentication server is prohibited from calling the second SSSD process to access the authentication server to query the authorization certificate of the user account, so as to prevent the servers in the Hadoop cluster from authorizing access to the user account.

[0157] Optionally, in step S2032, the authentication server calls the third SSSD process to cache the authorization certificate.

[0158] It is obvious to those skilled in the art that the modules or steps of the present invention described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. They can be implemented using computer-executable program code, and thus can be stored in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those described herein, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0159] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0160] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0161] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0162] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0163] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0164] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0165] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0166] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0167] As can be seen from the above description, the embodiments of this application achieve the following technical effects:

[0168] 1) The user creation method for a Hadoop cluster in this application firstly involves an authentication server obtaining the user's identity information and registering the user account based on this information. Each user account corresponds one-to-one with the identity information. The authentication server can be any server in the Hadoop cluster that provides authentication services. Then, the authentication server generates an authorization certificate based on the user account. This authorization certificate is bound to each user account and authorizes the user account to access servers in the Hadoop cluster. Finally, the authentication server calls a first SSSD process to synchronize the authorization certificate to all non-authentication servers, completing user creation. These non-authentication servers are servers in the Hadoop cluster other than the authentication server. This method creates users through the authentication server in the Hadoop cluster, generating user accounts and corresponding authorization certificates. By calling the first SSSD process to synchronize the authorization certificates to all non-authentication servers, the Hadoop cluster has authorization certificates corresponding to user accounts. This allows all servers in the Hadoop cluster to authorize user account access, eliminating the need for individual user creation on each server in the Hadoop cluster, thus solving the problem of complex user creation operations in existing technologies for Hadoop clusters.

[0169] 2) The user creation apparatus for a Hadoop cluster of this application comprises a first processing unit for an authentication server to obtain user identity information and register a user account based on the identity information, wherein the user account corresponds one-to-one with the identity information, and the authentication server is any server in the Hadoop cluster that provides authentication services; a generation unit for the authentication server to generate an authorization certificate based on the user account, wherein the authorization certificate is bound one-to-one with the user account, and the authorization certificate is a certificate authorizing the user account to access the servers in the Hadoop cluster; and a second processing unit for the authentication server to call a first SSSD process to synchronize the authorization certificate to all non-authentication servers, thereby completing user creation, wherein the non-authentication servers are servers in the Hadoop cluster other than the authentication server. This apparatus creates users through the authentication server in the Hadoop cluster, generates user accounts and corresponding authorization certificates, and synchronizes the authorization certificates to all non-authentication servers by calling the first SSSD process, ensuring that all servers in the Hadoop cluster have authorization certificates corresponding to the user accounts. This enables all servers in the Hadoop cluster to authorize user account access, eliminating the need for individual user creation on each server in the Hadoop cluster, thus solving the problem of complex user creation operations in the prior art for Hadoop clusters.

[0170] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for creating users in a Hadoop cluster, characterized in that, include: The authentication server obtains the user's identity information and registers the user based on the identity information to obtain a user account. The user account corresponds one-to-one with the identity information. The authentication server can be any server in the Hadoop cluster that provides authentication services. The authentication server generates an authorization certificate based on the user account. The authorization certificate is bound to the user account in a one-to-one correspondence. The authorization certificate is a certificate that authorizes the user account to access the server of the Hadoop cluster. The authentication server stores the authorization certificate, enabling non-authentication servers to access the authentication server through the first SSSD process to query the authorization certificate of the user account. The non-authentication server is a server other than the authentication server in the Hadoop cluster. The authentication server stores the authorization certificate, enabling non-authentication servers to access the authentication server through the first SSSD process to query the authorization certificate of the user account. This includes: when all servers in the Hadoop cluster have SSSD tools installed, the authentication server accepts the access request from the first SSSD process of the non-authentication server, the access request being used to query whether the authentication server stores the authorization certificate of the user account.

2. The method according to claim 1, characterized in that, After the authentication server saves the authorization certificate, the method further includes: If all servers in the Hadoop cluster have SSSD installed and the authentication server has locked the authorization certificate, the non-authentication server is prohibited from calling the second SSSD process to access the authentication server to query the authorization certificate of the user account, thereby preventing the servers in the Hadoop cluster from authorizing access to the user account.

3. The method according to claim 1, characterized in that, The authentication server obtains the user's identity information, including: The authentication server receives an access request from a third SSSD process, which is sent by any client connected to the third SSSD process, and the access request includes the identity information.

4. The method according to claim 3, characterized in that, The authentication server stores the authorization certificate, including: The authentication server invokes the third SSSD process to cache the authorization certificate.

5. The method according to any one of claims 1 to 4, characterized in that, The authentication server obtains the user's identity information and registers the user account based on the identity information, including: The authentication server calls the API interface to receive the identity information input by the client; The authentication server registers the user account based on the identity information.

6. The method according to any one of claims 1 to 4, characterized in that, The authentication server generates an authorization certificate based on the user account, including: The authentication server calls the LDAP authentication service to generate the authorization certificate corresponding to the user account.

7. A user creation device for a Hadoop cluster, characterized in that, include: The first processing unit is used to obtain the user's identity information and register according to the identity information to obtain a user account. The user account corresponds one-to-one with the identity information. The authentication server is any server in the Hadoop cluster that provides authentication services. The generation unit is used to generate an authorization certificate based on the user account. The authorization certificate is bound to the user account in a one-to-one correspondence. The authorization certificate is a certificate that authorizes the user account to access the server of the Hadoop cluster. The second processing unit is used to store the authorization certificate, so that a non-authentication server can access the authentication server through the first SSSD process to query the authorization certificate of the user account. The non-authentication server is a server other than the authentication server in the Hadoop cluster. The second processing unit includes a third processing module, which, when all servers in the Hadoop cluster have SSSD tools installed, accepts access requests from the first SSSD process of the non-authentication server, the access requests being used to query whether the authentication server stores the authorization certificate of the user account.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein, when the program is executed, it controls the device on which the computer-readable storage medium is located to perform the method according to any one of claims 1 to 6.

9. A user management system for a Hadoop cluster, characterized in that, include: One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs comprising methods for performing any one of claims 1 to 6.

Images