Database setup details for Cloudera Data Explorer (Hue) for TLS/TCPS-enabled databases

Data Explorer automatically uses +TLSv1.2 +TLSv1.3 when you create a Cloudera cluster with the Auto-TLS option. You can also enable TLS in Data Explorer configurations after you add the Data Explorer service to your cluster using Cloudera Manager.

If TLS 1.2 is enabled on the database servers, and the databases are restricted or enforced to use these protocols, then Data Explorer automatically uses the compatible ciphers to communicate with the database securely. You do not have to configure any setting in Hue's Advanced Configuration Snippet or any other configurations. This is applicable when using MySQL, MariaDB, or PostgreSQL databases as a backend database for Data Explorer.

The following TLS configurations are supported:

TLSv1.2: Enables TLS 1.2 exclusively.
TLSv1.3: Enables TLS 1.3 exclusively.
TLSv1.2 and TLSv1.3 (Default): Enables both TLS 1.2 and TLS 1.3 simultaneously.

To restrict the MySQL and MariaDB databases to use TLS 1.2, set the value of the require_secure_transport to true in the my.cnf file.

To enable TLS versions on the Data Explorer instance, go to Cloudera Manager > ClustersData Explorer > Configurations and select the Enable TLS/SSL for Hue option.

If TCPS is enabled on the Oracle database, then you can specify the connection string containing the TCPS protocol in the Database SID field.

You must have enabled TLS 1.3, or TCPS on the Data Explorer database.
You must have created database users.
You must have installed the MySQL client (for MySQL or MariaDB databases).
You must have installed the psycopg2 Python package (for PostgreSQL database).

Select the appropriate database type from the Type drop-down menu.
Enter the Fully Qualified Domain Name (FQDN) of the host on which you have installed the database in the Database Hostname field.
If the database is not running on its default port, then specify the port number in the following format: [***HUE-DB-HOST***]:[***DB-PORT***].

Where,
[***HUE-DB-HOST***] is the FQDN of the database host
[***DB-PORT***] is the database port
Specify the database name in the Database Name field.
For Oracle databases, specify the SID in the Database SID field.
If you are using Oracle Service Name instead of SID, then specify the database name in the following format:
```
[***HUE-DB-HOST***]:1521/[***SERVICE-NAME***]
```
Where,
[***HUE-DB-HOST***] is the FQDN of the database host
[***SERVICE-NAME***] is the Oracle service name
You can also specify the following connection string in the Database Name field:
```
(DESCRIPTION=(LOAD_BALANCE=off)(FAILOVER=on)(CONNECT_TIMEOUT=5)(TRANSPORT_CONNECT_TIMEOUT=3)(RETRY_COUNT=3)(ADDRESS=(PROTOCOL=TCPS)(HOST=[***HUE-DB-HOST***])(PORT=[***HUE-DB-PORT***]))(CONNECT_DATA=(SERVICE_NAME=[***SERVICE-NAME***])(SECURITY =
 (MY_WALLET_DIRECTORY = /[***PATH-TO-WALLET-FILE***])))
```
Where,
[***HUE-DB-HOST***] is the FQDN of the database host
[***HUE-DB-PORT***] is the port for the Data Explorer database
[***SERVICE-NAME***] is the Oracle service name
[***PATH-TO-WALLET-FILE***] is the location at which you have copied the wallet file (cwallet.sso) on the Data Explorer host
Enter the database username and password you set up for Data Explorer database in the Username and Password fields.
Click Test Connection.
If the connection test fails, review your configuration, fix any errors, and rerun the connection test.
Click Continue to continue with cluster installation.