[ZEPPELIN-3875] Groups are not derived when using ActiveDirectory

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.7.3, 0.8.0
• Fix Version/s: 0.9.0
• Component/s: security
• Assignee: Unassigned
• Reporter: Michal Vince
• Created: 21/Nov/18 12:33
• Updated: 24/Dec/20 03:19
• Resolved: 08/Jan/19 13:00

Description

ActiveDirectoryGroupRealm is using "userPrincipalName" for deriving groups that user belongs to, however:

• this field is not mandatory in ActiveDirectory
• can contain user email where domain is different from REALM

in such a scenario user is able to log in but no groups are derived

 

this was also mentioned in https://github.com/apache/zeppelin/pull/986 but never resolved

Issue Links

• links to: GitHub Pull Request #3233
• links to: GitHub Pull Request #3233