[ZEPPELIN-1472] Create new LdapRealm based on Apache Knox LdapRealm Class

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.6.1
• Fix Version/s: 0.7.0
• Assignee: Greg Senia
• Reporter: Greg Senia
• Created: 22/Sep/16 04:10
• Updated: 23/Aug/17 08:39
• Resolved: 20/Nov/16 22:21

Description

In our environment we attempted to use the ActiveDirectoryGroupRealm and the LdapGroupRealm but unfortunately those implementations against Shiro do not support ADLDAP Global Catalog. Also searching on "userPrincipalName" is risky in an AD environment since the explicit UPN vs Implicit UPN can be different. And the LDAP userPrincipalName attribute is the explicit UPN which can be defined by the directory administrator to any value and it can be duplicated.. SamAccountName is unique per domain and Microsoft states best practice is to not allow duplicate samAccountName's per the forest. I have attached a semi-working modified KnoxLdapRealm which works against samAccountName and global catalog for auth.

http://windowsitpro.com/active-directory/q-does-samaccountname-object-have-be-unique-active-directory-domain-or-entire-fores

https://jorgequestforknowledge.wordpress.com/2010/10/12/user-principal-names-in-ad-part-1/

Issue Links

• links to: GitHub Pull Request #1493
• links to: GitHub Pull Request #1513
• links to: GitHub Pull Request #1614