Community Articles

Find and share helpful community-sourced technical articles.
Labels (1)

In Zeppelin LDAP Authentication with OpenLDAP and How to Set Up OpenLDAP we've shown how to use LDAP Authentication with Zeppelin. In this article, we'll harden that configuration by ensuring that Zeppelin and OpenLDAP communicate over LDAPS.

LDAPS is a secure protocol that uses TLS to assure authenticity, confidentiality, and integrity of communications. This prevents man-in-the-middle attacks that sniff traffic to discover LDAP credentials communicated in plaintext, which could compromise the security of the cluster.

The first step is to modify the configuration of the OpenLDAP server, as root, to expose LDAPS connectivity, we'll need to modify /etc/openldap/ldap.conf. Please recall that we created /etc/openldap/certs/ in the How to Set Up OpenLDAP article

#TLS_CACERTDIR  /etc/openldap/certs
TLS_CACERT /etc/openldap/certs/
URI ldaps:// ldap://
BASE dc=field,dc=hortonworks,dc=com

We also need to modify /etc/sysconfig/slapd :

SLAPD_URLS="ldapi:/// ldap:/// ldaps:///"

Then restart slapd:

systemctl restart slapd

You can confirm that slapd is listening on 636:

netstat -anp | grep 636

Finally, confirm TLS connectivity and secure ldapsearch (with the appropriate bind user and password from the previous articles):

# should succeed
openssl s_client -connect </dev/null

# should succeed
ldapsearch -H ldaps:// -D cn=ldapadm,dc=field,dc=hortonworks,dc=com  -w $password -b "ou=People,dc=field,dc=hortonworks,dc=com"

The next step is the client-side configuration changes. Since we are using a self-signed certificate for the OpenLDAP server, we need to import this into the Java truststore, called cacerts, which is in /etc/pki/ca-trust/extracted/java on my CentOS 7 system.

Copy the file from the OpenLDAP server to the Zeppelin server (this file does not contain sensitive key material, only public keys), and run (making sure you set this certificate to be trusted):

keytool -import -alias myldap -file /etc/security/certificates/ -keystore cacerts

Otherwise, you will see errors like

Root exception is PKIX path building failed

Lastly, in Ambari, we just need to make one small change to the shiro.ini configuration in Zeppelin > Config > Advanced zeppelin-env > shiro_ini_content :

ldapRealm.contextFactory.url = ldaps://

Note the protocol change to LDAPS and the port number change to 636.

To test, restart the Zeppelin service and confirm that users can still log in to the Zeppelin UI.

Take a Tour of the Community
Don't have an account?
Your experience may be limited. Sign in to explore more.
Version history
Last update:
‎01-31-2017 11:19 PM
Updated by:
Top Kudoed Authors