Integrating Hue with LDAP

If an LDAP user needs to be part of a certain group and be given a particular set of permissions, you can import this user with the User Admin interface in Hue.

Groups can also be imported using the User Admin interface, and users can be added to this group. As in the image below, not only can groups be discovered using DN and rDN search, but users that are members of the group or members of its subordinate groups can be imported as well.

You have the following options available when importing a user/group:

• Distinguished name: If checked, the username provided must be a full distinguished name (for example, uid=hue,ou=People,dc=gethue,dc=com). Otherwise, the Username provided should be a fragment of a Relative Distinguished Name (rDN) (for example, the username hue maps to the rDN uid=hue). Hue performs an LDAP search using the same methods and configurations as described above. That is, Hue takes the provided username and creates a search filter using the user_filter and user_name_attr configurations.
• Create home directory: If checked, when the user is imported, their home directory in HDFS is automatically be created if it doesn’t already exist.

Users and groups can be synchronized with the directory service using the User Admin interface or using a command line utility. The image from the Importing LDAP Users and Groups section uses the words Add/Sync to indicate that when a user or group that already exists in Hue is being added, it is, in fact, synchronized instead. In the case of importing users for a particular group, new users are imported and existing users are synchronized.

<hue root>/build/env/bin/hue sync_ldap_users_and_groups

Hue also supports the ability to authenticate against multiple LDAP servers. Before attempting LDAP authentication against multiple servers, ensure you have configured LDAP synchronization for each server, as described in the previous section. As long as users and groups are synced across LDAP and Hue, authentication should work.

To configure multiple servers, determine the correct parameters for each server as described in the Integrating Hue with LDAP section above. In the hue.ini file, create a configuration section for each LDAP server under [[[ldap_servers]]] named for the respective LDAP server, with the format [[[[<ldap_server>]]]].

If you are using Cloudera Manager, you can add the configuration section using an Advanced Configuration Snippet:

1. Go to the Hue Service.
2. Click Configuration.
3. Select Category > Advanced.
4. Locate the Hue Service Advanced Configuration Snippet (Safety Valve) for hue_safety_valve.ini property and add a code snippet for each LDAP server. For example, for the server AD1.TEST.COM:

   [desktop]
   [[ldap]]
   [[[ldap_servers]]]
   [[[[AD1.TEST.COM]]]]
   ldap_url=ldap://w2k8-ad1
   search_bind_authentication=true
   create_users_on_login=true
   base_dn="cn=users,dc=ad1,dc=test,dc=com"
   bind_dn="cn=Administrator,cn=users,dc=ad1,dc=test,dc=com"
   bind_password="Password1"
   [[[[AD2.TEST.COM]]]]
   ldap_url=ldap://w2k8-ad2
   search_bind_authentication=true
   create_users_on_login=true
   base_dn="cn=users,dc=ad2,dc=test,dc=com"
   bind_dn="cn=Administrator,cn=users,dc=ad2,dc=test,dc=com"
   bind_password="Password1"

5. Click Save Changes.
6. Restart the Hue service.

The first step to diagnosing an LDAP issue is to run the ldapsearch command on the user or group that is involved in the authentication failure. The ldapsearch command gives you a snapshot of the state of the directory for a user or group. You can use the command to make sure the user or group has been configured as expected. The rest of this section will walk you through the Hue configuration required for some common deployment scenarios. Once you have made sure that hue.ini was configured properly, enable LDAP debugging to be able to audit LDAP actions in the Hue logs.