[HIVE-7193] Hive should support additional LDAP authentication parameters

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.10.0
• Fix Version/s: 1.3.0, 2.0.0
• Assignee: Naveen Gangam
• Reporter: Mala Chikka Kempanna
• Created: 06/Jun/14 23:11
• Updated: 16/Feb/16 23:49
• Resolved: 22/Jun/15 20:18

Description

Currently hive has only following authenticator parameters for LDAP authentication for hiveserver2:

<property> 
  <name>hive.server2.authentication</name> 
  <value>LDAP</value> 
</property> 
<property> 
  <name>hive.server2.authentication.ldap.url</name> 
  <value>ldap://our_ldap_address</value> 
</property> 

We need to include other LDAP properties as part of hive-LDAP authentication like below:

a group search base -> dc=domain,dc=com 
a group search filter -> member={0} 
a user search base -> dc=domain,dc=com 
a user search filter -> sAMAAccountName={0} 
a list of valid user groups -> group1,group2,group3 

Issue Links

• breaks: HIVE-12007 Hive LDAP Authenticator should allow just Domain without baseDN (for AD)
• contains: HIVE-9880 Support configurable username attribute for HiveServer2 LDAP authentication
• is depended upon by: HIVE-6026 Ldap Authenticator should be more generic with BindDN
• is depended upon by: HIVE-8190 LDAP user match for authentication on hiveserver2
• is depended upon by: HIVE-11512 Hive LDAP Authenticator should also support full DN in Authenticate()
• is related to: HIVE-12885 LDAP Authenticator improvements
• is required by: HIVE-12079 Add units tests for HiveServer2 LDAP filters added in HIVE-7193