[ZEPPELIN-2794] User/group mapping rules similar to Hadoop's auth_to_local

• Type: New Feature
• Status: Open
• Priority: Blocker
• Resolution: Unresolved
• Affects Version/s: 0.7.0
• Component/s: Core

Environment

HDP 2.6 + Kerberos + AD LDAP multi-domain forest

• Assignee: Unassigned
• Reporter: Hari Sekhon
• Created: 18/Jul/17 10:58
• Updated: 13/Jul/20 15:21

Description

Feature Request to add user/group mapping rules similar to Hadoop's auth_to_local.

This will allow munging users/groups and rule based remappings to differentiate duplicate users in multi-domain Active Directory forests where the LDAP results returned from the global catalog include duplicate usernames which need to be translated with a prefix/suffix in order to differentiate between domains to prevent users from different domains sharing logins, permissions etc.

I understand that Shiro is responsible for this integration and have raised SHIRO-631, but thought I'd create this top level Zeppelin ticket to track Zeppelin's ability to support this scenario as it'll need to upgrade to a later Shiro version when Shiro supports this.

Issue Links

• depends upon: SHIRO-631 Principal mapping rules similar to Hadoop's auth_to_local