Details
-
Improvement
-
Status: Closed
-
Major
-
Resolution: Fixed
-
1.3.0
-
None
Description
As more usecases, for various LDAP flavors and deployments, emerge, Hive's LDAP authentication provider needs additional configuration properties to make it more flexible to work with different LDAP deployments.
For example:
1) Not every LDAP server supports a "memberOf" property on user entries that refer to the groups the user belongs to. This attribute is used for group filter support. So instead of relying on this attribute to be set, we can reverse the search and find all the groups that have an attribute, that refers to its members, set. For example "member" or "memberUid" etc.
Since this atttribute name differs from ldap to ldap, its best we make this configurable, with a default value of "member"
2) In HIVE-12885, a new property was introduced to make the attribute for an user/group search key user-configurable instead of assuming its "uid" (when baseDN is set) or "cn" (otherwise). This change was deferred from the initial patch.
3) LDAP Groups can have various ObjectClass'es. For example objectClass=group or objectClass=groupOfNames or objectClass=posixGroup or objectClass=groupOfUniqueNames etc. There could be other we dont know of.
So we need a property to make this user-configurable with a certain default.
4) There is also a bug where the lists for groupFilter and userFilter are not re-initialized each time init() is called.
These lists are only re-initialized if the new HiveConf has userFilter or groupFilter set values. Otherwise, the provider will use values from previous initialization.
I found this bug when writing some new tests.
Attachments
Attachments
Issue Links
- contains
-
HIVE-12079
Add units tests for HiveServer2 LDAP filters added in HIVE-7193
-
- Closed
-
- links to
