Support Questions
Find answers, ask questions, and share your expertise
Announcements
Alert: Welcome to the Unified Cloudera Community. Former HCC members be sure to read and learn how to activate your account here.

CompositeGroupsMapping

Solved Go to solution

CompositeGroupsMapping

Explorer

CDM shows these group mapping providers (hadoop.security.group.mapping):

- jniBasedUnixGroupsMapping

- ShellBasedUnixGroupsMapping

- LdapGroupsMapping

 

In 2012 a CompositeGroupsMappings provider was created, but I don't see it in CDM (v5.7.1)

 

Is it possible to configure CDM to use the CompositeGroupsMappings provider using a safety valve?

- the LdapGroupsMapping should be used for regular users

- the ShellBasedUnixGroupsMapping should be used for system accounts, like hdfs & yarn

 

thanks

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted

Re: CompositeGroupsMapping

Super Collaborator

The code is there and you can use it if you want it but we do not expose it in the Cloudera Manager UI. You will need to use a configuration snippet in the HDFS service for core-site.xml (cluster wide) and add the relevant keys:

 

hadoop.security.group.mapping -> org.apache.hadoop.security.CompositeGroupsMapping
hadoop.security.group.mapping.providers -> ProviderName1,ProviderName2
hadoop.security.group.mapping.providers.combined -> true
hadoop.security.group.mapping.providers.<ProviderName1>

That should work.

 

Wilfred

2 REPLIES 2
Highlighted

Re: CompositeGroupsMapping

Super Collaborator

The code is there and you can use it if you want it but we do not expose it in the Cloudera Manager UI. You will need to use a configuration snippet in the HDFS service for core-site.xml (cluster wide) and add the relevant keys:

 

hadoop.security.group.mapping -> org.apache.hadoop.security.CompositeGroupsMapping
hadoop.security.group.mapping.providers -> ProviderName1,ProviderName2
hadoop.security.group.mapping.providers.combined -> true
hadoop.security.group.mapping.providers.<ProviderName1>

That should work.

 

Wilfred

Re: CompositeGroupsMapping

Explorer

the configuration works fine

 

only issue is that the bind user password is not redacted in the advanced configuration snippet and in clear text in the core-site.xml

 

According to the security guide (sensitive data redaction), v5.8.x (not documented for 5.7.x):

Redaction of Advanced Configuration Snippet parameters is based on detecting keywords explicitly defined as sensitive in the contents of these parameters. That is, parameters containing the keywords password, key, aws, or secret, will be redacted for users who do not have the required edit privileges

 

I'll open a case to check how to get this working on 5.7.1

 

Don't have an account?
Coming from Hortonworks? Activate your account here