title: Making Hadoop Accessible to your Employees with LDAP author: admin type: post date: 2014-02-03T18:40:00+00:00 url: /making-hadoop-accessible-to-your-employees-with-ldap/ tumblr_gethue_permalink:
Last updated on July 9th 2015
Hue easily integrates with your corporation’s existing identity management systems and provides authentication mechanisms for SSO providers. By changing a few configuration parameters, your employees can start doing big data analysis in their browser by leveraging an existing security policy.
This blog post details the various features and capabilities available in Hue for LDAP:
Synchronizing users and groups
The typical authentication scheme for Hue takes of the form of the following image:
Passwords are saved into the Hue databases.
With the Hue LDAP integration, users can use their LDAP credentials to authenticate and inherit their existing groups transparently. There is no need to save or duplicate any employee password in Hue:
There are several other ways to authenticate with Hue: PAM, SPNEGO, OpenID, OAuth, SAML2, etc. This section details how Hue can authenticate against an LDAP directory server.
When authenticating via LDAP, Hue validates login credentials against a directory service if configured with this authentication backend:
{{< highlight bash >}}'desktop]
[[auth]]
backend=desktop.auth.backend.LdapBackend
{{< /highlight >}}
The LDAP authentication backend will automatically create users that don’t exist in Hue by default. Hue needs to import users in order to properly perform the authentication. The password is never imported when importing users. The following configuration can be used to disable automatic import:
{{< highlight bash >}}'desktop]
[[ldap]]
create_users_on_login=false
{{< /highlight >}}
The purpose of disabling the automatic import is to only allow to login a predefined list of manually imported users.
The case sensitivity of the authentication process is defined in the “Case sensitivity” section below.
Note
If a user is logging in as A before enabling LDAP auth and then after enabling LDAP auth logs in as B, all workflows, queries etc will be associated with the user A and be unavailable. The old workflows would need to have their owner fields changed to B: this can be done in the Hue shell.
There are two different ways to authenticate with a directory service through Hue:
The search bind mechanism for authenticating will perform an ldapsearch against the directory service and bind using the found distinguished name (DN) and password provided. This is, by default, used when authenticating with LDAP. The configurations that affect this mechanism are outlined in “LDAP search”.
The direct bind mechanism for authenticating will bind to the ldap server using the username and password provided at login. There are two options that can be used to choose how Hue binds:
If ‘nt_domain’ is provided, then Hue will use a UPN to bind to the LDAP service:
{{< highlight bash >}}'desktop]
[[ldap]]
nt_domain=example.com
{{< /highlight >}}
Otherwise, the ‘ldap_username_pattern’ configuration is used (the parameter will be replaced with the username provided at login):
{{< highlight bash >}}'desktop]
[[ldap]]
ldap_username_pattern="uid=,ou=People,DC=hue-search,DC=ent,DC=cloudera,DC=com"
{{< /highlight >}}
Typical attributes to search for include:
To enable direct bind authentication, the ‘search_bind_authentication’ configuration must be set to false:
{{< highlight bash >}}'desktop]
[[ldap]]
search_bind_authentication=false
{{< /highlight >}}
If an LDAP user needs to be part of a certain group and have a particular set of permissions, then this user can be imported via the Useradmin interface:
As you can see, there are two options available when importing:
If ‘Create home directory’ is checked, when the user is imported their home directory in HDFS will automatically be created, if it doesn’t already exist.
If ‘Distinguished name’ is checked, then the username provided must be a full distinguished name (eg: uid=hue,ou=People,dc=gethue,dc=com). Otherwise, the Username provided should be a fragment of a Relative Distinguished Name (rDN) (e.g., the username “hue” maps to the rDN “uid=hue”). Hue will perform an LDAP search using the same methods and configurations as defined in the “LDAP search” section. Essentially, Hue will take the provided username and create a search filter using the ‘user_filter’ and ‘user_name_attr’ configurations. For more information on how Hue performs LDAP searches, see the “LDAP Search” section.
The case sensitivity of the search and import processes are defined in the “Case sensitivity” section.
Groups are importable via the Useradmin interface. Then, users can be added to this group, which would provide a set of permissions (e.g. accessing the Impala application). This function works almost the exact same way as user importing, but has a couple of extra features.
As the above image portrays, not only can groups be discovered via DN and rDN search, but users that are members of the group and members of the group’s subordinate groups can be imported as well. Posix groups and members are automatically imported if the group found has the object class ”posixGroup”.
Users and groups can be synchronized with the directory service via the Useradmin interface or via a command line utility. The images from the previous sections use the words “Sync” to indicate that when a name of a user or group that exists in Hue is being added, it will in fact be synchronized instead. In the case of importing users for a particular group, new users will be imported and existing users will be synchronized. Note: Users that have been deleted from the directory service will not be deleted from Hue. Those users can be manually deactivated from Hue via the Useradmin interface.
The groups of a user can be synced when he logs in (to keep its permission in sync):
{{< highlight bash >}}'desktop]
[[ldap]]
# Synchronize a users groups when they login
## sync_groups_on_login=false
{{< /highlight >}}
Currently, only the first name, last name, and email address are synchronized. Hue looks for the LDAP attributes ‘givenName’, ‘sn’, and ‘mail’ when synchronizing. Also, the ‘user_name_attr’ config is used to appropriately choose the username in Hue. For instance, if ‘user_name_attr’ is set to “uid”, then the “uid” returned by the directory service will be used as the username of the user in Hue.
The “Sync LDAP users/groups” button in the Useradmin interface will automatically synchronize all users and groups.
Here’s a quick example of how to use the command line interface to synchronize users and groups:
<hue root>/build/env/bin/hue sync_ldap_users_and_groups
There are two configurations for restricting the search process:
Here is an example configuration:
{{< highlight bash >}}'desktop]
[[ldap]]
[[[users]]]
user_filter=”objectClass=*”
user_name_attr=uid
# Whether or not to follow referrals
## follow_referrals=false
{{< /highlight >}}
With the above configuration, the LDAP search filter will take on the form:
(&(objectClass=*)(uid=<user entered usename>))
Hue can be configured to ignore the case of usernames as well as force usernames to lower case via the ‘ignore_username_case’ and ‘force_username_lowercase’ configurations. These two configurations are recommended to be used in conjunction with each other. This is useful when integrating with a directory service containing usernames in capital letters and unix usernames in lowercase letters (which is a Hadoop requirement). Here is an example of configuring them:
[desktop]
{{< highlight bash >}}'desktop]
[[ldap]]
ignore_username_case=true
force_username_lowercase=true
{{< /highlight >}}
Secure communication with LDAP is provided via the SSL/TLS and StartTLS protocols. It allows Hue to validate the directory service it’s going to converse with. Practically speaking, if a Certificate Authority Certificate file is provided, Hue will communicate via LDAPS:
{{< highlight bash >}}'desktop]
[[ldap]]
ldap_cert=/etc/hue/ca.crt
{{< /highlight >}}
The StartTLS protocol can be used as well (step up to SSL/TLS):
{{< highlight bash >}}'desktop]
[[ldap]]
use_start_tls=true
{{< /highlight >}}
Get more information when querying LDAP and use the ldapsearch tool:
{{< highlight bash >}}'desktop]
[[ldap]]
debug=true
# Sets the debug level within the underlying LDAP C lib.
## debug_level=255
# Possible values for trace_level are 0 for no logging, 1 for only logging the method calls with arguments,
# 2 for logging the method calls with arguments and the complete results and 9 for also logging the traceback of method calls.
trace_level=0
{{< /highlight >}}
Note
Make sure to add to the Hue server environment:
{{< highlight bash >}}DESKTOP_DEBUG=true
DEBUG=true{{< /highlight >}}
The Hue team is working hard on improving security. Upcoming LDAP features include: Import nested LDAP groups and multidomain support for Active Directory. We hope this brief overview of LDAP in Hue will help you make your system more secure, more compliant with current security standards, and open up big data analysis to many more users!