一种基于LDAP+Kerberos实现的大数据租户身份验证与数据鉴权的管理服务平台设计方案  

A design of multi-tenant service platform based on LDAP and Kerberos

作　　者：肖旻砚 高恩伟 陆海俊 徐京华 XIAO Min-yan;GAO En-wei;LU Hai-jun;XU Jing-hua(China Mobile(Hangzhou)Information Technology Co.,Ltd.,Hangzhou 311121,China)

机构地区：[1]中移(杭州)信息技术有限公司,杭州311121

出　　处：《电信工程技术与标准化》2023年第3期76-82,共7页Telecom Engineering Technics and Standardization

摘　　要：在大数据时代,为了提升集群服务器的利用效率,实现资源集约化和统一管理,向不同的用户提供安全可靠和易于操作的大数据多租户服务系统的需求随之出现。基于这种需求,本文提出一种大数据租户身份验证与数据鉴权的管理服务平台,其多租户体系由LDAP、Kerberos和自研的权限中心配合实现。其中,LDAP与Kerberos集成实现租户的管理与保障租户身份鉴定的安全性,权限中心与LDAP配合实现租户权限策略的存储与访问。此外,管理服务平台还能够根据Hadoop集群服务节点资源情况灵活部署,通过与租户建立映射实现平台账号间的信息隔离,对多租户系统中组件的运行状态提供监控,并为多租户系统提供可视化的操作页面。With the rapid application of big data,the technology about resource-saving and monitor on cluster server become more and more important,thus the demand for convenient and reliable multi-tenant system emerges.This paper defi nes a multi-tenant service platform for tenant security and authentication,of which multi-tenant system is based on the integrated Kerberos-LDAP and the integrated LDAP-PAC,the integrated Kerberos-LDAP is designed for the tenant administration and the security of tenant authentication,the integrated LDAP–PAC is designed for the storage and visit of permission policies,the platform can also provide lots of service for application’s deployment,information isolation between accounts through mapped tenants,monitor on package of multi-tenant and view pages for the multi-tenant.

关 键 词：大数据 多租户 平台 

分 类 号：TN915[电子电信—通信与信息系统]