[HIVE-14592] In LDAP authentication 'group filter' match should be case insensitive

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.2.0
• Component/s: Authentication
• Assignee: Kapil Rastogi
• Reporter: Kapil Rastogi
• Created: 20/Aug/16 01:30
• Updated: 20/Aug/16 01:30

Description

Configure openLDAP server with following configurations(enable ldap, ldap URI, baseDN, userDNPattern, groupDNPattern and groupFilter). If the specified groupFilter case is different than the actual one in directory than Hive cannot find a match and errors out.

Provided groupFilter value <groupTest>
Actual group name in directory server - grouptest.

Similar search works by using ldapsearch (ldap searches are case insensitive).

Error message snippet -
avax.security.sasl.AuthenticationException: Authentication failed: User not a member of listed groups]
at org.apache.hive.service.auth.PlainSaslServer.evaluateResponse(PlainSaslServer.java:109)