[HADOOP-9477] Add posixGroups support for LDAP groups mapping service

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.0.4-alpha
• Fix Version/s: 2.8.0, 3.0.0-alpha1, 2.7.6
• Target Version/s: 2.0.4-alpha
• Hadoop Flags: Reviewed

Release Note

Add posixGroups support for LDAP groups mapping service. The change in LDAPGroupMapping is compatible with previous scenario. In LDAP, the group mapping between {{posixAccount}} and {{posixGroup}} is different from the general LDAPGroupMapping, one of the differences is the {{"memberUid"}} will be used to mapping {{posixAccount}} and {{posixGroup}}. The feature will handle the mapping in internal when configuration {{hadoop.security.group.mapping.ldap.search.filter.user}} is set as "posixAccount" and {{hadoop.security.group.mapping.ldap.search.filter.group}} is "posixGroup".

• Assignee: Dapeng Sun Assign to me
• Reporter: Kai Zheng
• Created: 16/Apr/13 05:39
• Updated: 06/Mar/18 19:25
• Resolved: 12/Mar/15 22:17

Description

It would be nice to support posixGroups for LdapGroupsMapping service. Below is from current description for the provider:
hadoop.security.group.mapping.ldap.search.filter.group:
An additional filter to use when searching for LDAP groups. This should be
changed when resolving groups against a non-Active Directory installation.
posixGroups are currently not a supported group class.

Issue Links

• Dependent: HADOOP-12793 Write a new group mapping service guide
• is broken by: HADOOP-12001 Limiting LDAP search conflicts with posixGroup addition
• is related to: HADOOP-12568 Update core-default.xml to describe posixGroups support