question Re: Apache Knox LDAP configuration is not used in Support Questions

Apache Knox LDAP configuration is not used

daba — Tue, 21 Apr 2026 08:03:16 GMT

Hello all,

I have installed Apache Knox on a CDP 7.1.6 cluster and switched Shiro from PAM to LDAP (as described here https://is.gd/FmexUD). The changes are also done in the providers. PAM is disabled via the authentication.param.remove switch. Nevertheless PAM (KnoxPamRealm) is used for authentication instead of LDAP (KnoxLdapRealm). Does anyone have useful hints where to look for the cause? Thanks a lot!

Regards,

Daniel

Re: Apache Knox LDAP configuration is not used

Scharan — Thu, 02 Dec 2021 00:49:50 GMT

@daba Can you try adding the below lines to the Knox topology files

authentication.param.remove=main.pamRealm authentication.param.remove=main.pamRealm.service

Refer to the following doc for more info on how to configure LDAP/AD in knox

https://docs.cloudera.com/runtime/7.2.10/knox-authentication/topics/security-knox-authe-ldap.html

Re: Apache Knox LDAP configuration is not used

daba — Thu, 02 Dec 2021 08:12:41 GMT

Hello @Scharan,

many thanks for your answer! Both parameters you mentioned are set. In the Knox Admin UI, all relevant providers also have the LDAP configuration (KnoxLdapRealm). But KnoxPamRealm is still used. It is interesting that when Knox is started, the shiro.ini with the PAM configuration is pulled from the JAR (WEB-INF/shiro.ini). Otherwise, there is no other shiro.ini in the file system that could replace it.

Re: Apache Knox LDAP configuration is not used

pvishnu — Tue, 28 Dec 2021 10:43:34 GMT

Hi @daba,

Could you check the following topology file in the Knox gateway node to validate if the authentication provider change you made in the CM UI is reflected at the host level as well?

- /var/lib/knox/gateway/conf/topologies/knoxsso.xml

Thanks,
Prashanth Vishnu

Re: Apache Knox LDAP configuration is not used

daba — Mon, 14 Feb 2022 07:27:05 GMT

Hi @pvishnu,

thank you for your response! The ldap configuration which I made in the Cloudera Manager will not be persist in the topology file /var/lib/knox/gateway/conf/topologies/knoxsso.xml. There is still the pamRealm configuration. One solution is to manually edit the topology file, but that is not my expectation if you use Cloudera Manager.

Regards,

Daniel