Securing Azure Credentials in PXF Configuration (abfss-site.xml)

Products

• VMware Tanzu Data Suite
• VMware Tanzu Greenplum
• VMware Tanzu Greenplum / Gemfire

Issue/Introduction

By default, PXF cluster configuration files such as abfss-site.xml store Azure Storage account keys and OAuth2 client secrets in plain text. Organizations requiring high security may want to avoid exposing these credentials on the filesystem and instead seek a method to secure them or pull them from a vault.

Environment

• Product: VMware Tanzu Greenplum
• Component: Platform Extension Framework (PXF)
• Protocol: ABFSS (Azure Blob File System)
• Configuration File: abfss-site.xml

Cause

PXF utilizes the standard Hadoop configuration framework, which reads properties from XML files. If the property fs.azure.account.oauth2.client.secret or fs.azure.account.key.<account_name>.dfs.core.windows.net is defined directly in the XML, it remains visible to any user with read access to the PXF configuration directory.

 

Resolution

While PXF does not natively call a Vault API directly, it supports the Hadoop Credential Provider API. This allows secrets to be stored in an encrypted Java KeyStore (JCEKS) file rather than as plain text in the XML configuration.

Prerequisites

• Access to the Greenplum coordinator host.
• The hadoop command-line utility must be available in the path.

Steps to Secure Credentials

1. Create the Encrypted Credential Store
   Use the hadoop credential command to create a JCEKS file. This file will store the sensitive secret under an alias. Replace <your_secret> with the actual Azure secret and specify a secure path within your PXF_BASE.

   hadoop credential create fs.azure.account.oauth2.client.secret -value <your_secret> -provider localjceks://file/usr/local/pxf-gp6/conf/azure.jceks

    

2. Update the abfss-site.xml Configuration
   Open your abfss-site.xml (located in $PXF_BASE/servers/<server_name>/).

   • Remove the plain-text property: fs.azure.account.oauth2.client.secret.
   • Add the following property to point PXF to the credential provider (Ensure that the path is the same as specified in the previous step):
     
     
   <property>
   <name>hadoop.security.credential.provider.path</name>
   <value>localjceks://file/usr/local/pxf-gp6/conf/azure.jceks</value>
</property>
   
   

3. Synchronize the Configuration
   The JCEKS file and the updated XML must be present on all segment hosts. Use the PXF cluster command to distribute the changes:
   
   pxf cluster sync

    
4. Verify Access
   Attempt to query the external table associated with this server. PXF will now decrypt the secret from the JCEKS file at runtime to authenticate with Azure.

Additional Information

Hadoop Credential Provider