[HADOOP-13771] Adding group mapping lookup utility without dependency on HDFS namenode

• Type: Bug
• Status: Patch Available
• Priority: Major
• Resolution: Unresolved
• Component/s: security, tools
• Assignee: Xiaoyu Yao
• Reporter: Xiaoyu Yao
• Created: 28/Oct/16 22:24
• Updated: 01/Nov/16 19:23

Description

We have hdfs groups command to troubleshoot issues related to users' group member look up with Unix/LDAP. However, there are some limitation of this command: 1) it can only be executed when namenode is running. 2) any change in the group mapping lookup configuration needs a hdfs namenode restart, which is expensive.

This ticket is proposed to have a simple CLI utility like HadoopKerberosName

hadoop org.apache.hadoop.security.HadoopKerberosName nn/[e-mail]

The CLI utility for group member lookup will have a usage like below without namenode running or restart for configuration change.

hadoop org.apache.hadoop.security.Groups hdfs
hdfs : [hadoop, hdfs]