question Why can't we use LDAP for Hadoop authentication? in Support Questions

Why can't we use LDAP for Hadoop authentication?

tim_david1954 — Fri, 16 Sep 2022 10:38:53 GMT

We all know that Hadoop needs Kerberos to be fully secure. LDAP is an authentication solution used with several Hadoop tools (Ambari, Nifi, Ambari, etc). Why we need Kerberos in addition of LDAP ?

Re: Why can't we use LDAP for Hadoop authentication?

amcbarnett — Sun, 18 Aug 2019 13:19:45 GMT

Here is your answer: You can easily spoof your Hadoop cluster with a change of a simple environment variable.

Re: Why can't we use LDAP for Hadoop authentication?

tim_david1954 — Mon, 12 Sep 2016 22:14:41 GMT

@Ancil McBarnett

Thanks, I am already aware of this. My question is more on why we can not use LDAP ? is it because Hadoop doesn't support it and we can some day implement and LDAP integration ? or because LDAP is lacking a feature, hence can not and will never replace Kerberos ?

Re: Why can't we use LDAP for Hadoop authentication?

amcbarnett — Mon, 12 Sep 2016 22:36:11 GMT

You can use LDAP in ADDITION to Kerberos. LDAP is the authentication authority. Kerberos is the ticketing system. LDAP is like the DMV giving you your driver's licence. Kerberos is your boarding pass to get on the plane. Kerberos can be enabled with AD, FreeIPA as your LDAP in HAdoop. Ambari, Nifi, Ranger will authenticate with those LDAPs. The only exception is Hive where when Kerberos is enabled it replaces LDAP authentication.