Skip to main content
daba
daba
Silver ⭐️⭐️
December 1, 2021
Question

Apache Knox LDAP configuration is not used

Hello all,

 

I have installed Apache Knox on a CDP 7.1.6 cluster and switched Shiro from PAM to LDAP (as described here https://is.gd/FmexUD). The changes are also done in the providers. PAM is disabled via the authentication.param.remove switch. Nevertheless PAM (KnoxPamRealm) is used for authentication instead of LDAP (KnoxLdapRealm). Does anyone have useful hints where to look for the cause? Thanks a lot!

 

Regards,

Daniel

 

4 replies

Scharan
Gold ⭐️
Scharan
Gold ⭐️
December 2, 2021

@daba Can you try adding the below lines to the Knox topology files

authentication.param.remove=main.pamRealm
authentication.param.remove=main.pamRealm.service

Refer to the following doc for more info on how to configure LDAP/AD in knox

https://docs.cloudera.com/runtime/7.2.10/knox-authentication/topics/security-knox-authe-ldap.html

Translate
daba
dabaAuthor
Silver ⭐️⭐️
December 2, 2021

Hello @Scharan,

 

many thanks for your answer! Both parameters you mentioned are set. In the Knox Admin UI, all relevant providers also have the LDAP configuration (KnoxLdapRealm). But KnoxPamRealm is still used. It is interesting that when Knox is started, the shiro.ini with the PAM configuration is pulled from the JAR (WEB-INF/shiro.ini). Otherwise, there is no other shiro.ini in the file system that could replace it.

Translate
pvishnu
Gold ⭐️
pvishnu
Gold ⭐️
December 28, 2021

Hi @daba,

 

Could you check the following topology file in the Knox gateway node to validate if the authentication provider change you made in the CM UI is reflected at the host level as well?

- /var/lib/knox/gateway/conf/topologies/knoxsso.xml

 

Thanks,
Prashanth Vishnu

Translate
Terms & ConditionsAccessibility statement