Hive ldap authentication group filter

Viewed 129

Use case : I am trying to set up EMR cluster which can be connected to jdbc for querying hive. I have decided to go for ldap authentication and I am able to authenticate

Problem : I am trying to restrict who can authenticate to cluster using group filter or custom filter using this document hive-ldap, when i authenticate using email it is trying to search for my email id's prefix in the ldap and it is not able to find (since my username is different from email id prefix). Do any one know how to fix it

hive-site.xml :

  <property>
    <name>hive.server2.authentication.ldap.baseDN</name>
    <value>DC=some,DC=com</value>
  </property>

  <property>
    <name>hive.server2.authentication.ldap.groupDNPattern</name>
    <value>CN=%s,CN=something,OU=something,DC=some,DC=com</value>
  </property>
<property>
    <name>hive.server2.authentication.ldap.groupFilter</name>
    <value>group_name</value>
</property>

<property>
  <name>hive.server2.authentication.ldap.userMembershipKey</name>
  <value>memberOf</value>
</property>
<property>
    <name>hive.server2.authentication.ldap.groupClassKey</name>
    <value>groupOfNames</value>
</property>
<property>
    <name>hive.server2.authentication.ldap.groupMembershipKey</name>
    <value>member</value>
</property>

  <property>
    <name>hive.server2.authentication.ldap.binddn</name>
    <value>CN=something,OU=something,DC=some,DC=com</value>
  </property>
  <property>
    <name>hive.server2.authentication.ldap.bindpw</name>
    <value>bind_password</value>
  </property>


  <property>
    <name>hive.server2.authentication</name>
    <value>LDAP</value>
  </property>

  <property>
    <name>hive.server2.transport.mode</name>
    <value>binary</value>
  </property>

  <property>
    <name>hive.users.in.admin.role</name>
    <value>admin_user</value>
  </property>

  <property>
    <name>hive.server2.authentication.ldap.url</name>
    <value>ldaps://ldap.some.com:1234</value>
  </property>

Error message

2021-07-16T22:24:26,405 INFO  [HiveServer2-Handler-Pool: Thread-37([])]: ldap.LdapSearch (LdapSearch.java:findUserDn(100)) - Expected exactly one user result for the user: first_name.last_name, but got 0. Returning null
2021-07-16T22:24:26,406 ERROR [HiveServer2-Handler-Pool: Thread-37([])]: transport.TSaslTransport (TSaslTransport.java:open(315)) - SASL negotiation failure
0 Answers
Related