[AMBARI-21873] Grant admin privileges to users belonging to specific LDAP groups during LDAP sync

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.5.0
• Fix Version/s: 2.6.0
• Component/s: ambari-server
• Assignee: Laszlo Puskas
• Reporter: Laszlo Puskas
• Created: 04/Sep/17 09:54
• Updated: 29/Nov/17 14:51
• Resolved: 05/Sep/17 09:25

Description

This feature adds the possibility to handle users belonging to a defined LDAP groups as ambari administrators during the LDAP sync.

The list of the groups that need to be considered is stored in the ambari property:

authorization.ldap.adminGroupMappingRules

The solution is to grant admin privileges to users belonging to these groups on LDPA sync.

Warning:

• changes in the LDAP group memberships will not be reflected in Ambari after the sync (eg.: administrator privileges won't be automatically revoked if users are removed from the groups listed in the property)
• administrator privileges can be granted/removed by another administrator, thus these actions can interfere
• if groups are not synced, this property is not taken into account

Issue Links

• is related to: AMBARI-20731 Automatic mapping of external users to Administrator does not work
• links to: Review Board