[HADOOP-8943] Support multiple group mapping providers

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.5.0
• Component/s: security
• Target Version/s: 2.0.3-alpha
• Hadoop Flags: Reviewed
• Tags: Group Mapping
• Assignee: Kai Zheng
• Reporter: Kai Zheng
• Created: 19/Oct/12 02:39
• Updated: 12/Feb/16 22:58
• Resolved: 26/Jun/14 19:21

Description

Discussed with Natty about LdapGroupMapping, we need to improve it so that:
1. It's possible to do different group mapping for different users/principals. For example, AD user should go to LdapGroupMapping service for group, but service principals such as hdfs, mapred can still use the default one ShellBasedUnixGroupsMapping;

2. Multiple ADs can be supported to do LdapGroupMapping;

3. It's possible to configure what kind of users/principals (regarding domain/realm is an option) should use which group mapping service/mechanism.

4. It's possible to configure and combine multiple existing mapping providers without writing codes implementing new one.

Issue Links

• Dependent: HADOOP-12797 Write a better tutorial for LdapGroupsMapping and CompositeGroupsMapping
• is related to: HADOOP-4656 Add a user to groups mapping service