CompositeGroupsMapping

[#1]

CDM shows these group mapping providers (hadoop.security.group.mapping):

- jniBasedUnixGroupsMapping

- ShellBasedUnixGroupsMapping

- LdapGroupsMapping

In 2012 a CompositeGroupsMappings provider was created, but I don't see it in CDM (v5.7.1)

Is it possible to configure CDM to use the CompositeGroupsMappings provider using a safety valve?

- the LdapGroupsMapping should be used for regular users

- the ShellBasedUnixGroupsMapping should be used for system accounts, like hdfs & yarn

thanks

[#2 · Accepted solution]

The code is there and you can use it if you want it but we do not expose it in the Cloudera Manager UI. You will need to use a configuration snippet in the HDFS service for core-site.xml (cluster wide) and add the relevant keys:

hadoop.security.group.mapping -> org.apache.hadoop.security.CompositeGroupsMapping
hadoop.security.group.mapping.providers -> ProviderName1,ProviderName2
hadoop.security.group.mapping.providers.combined -> true
hadoop.security.group.mapping.providers.<ProviderName1>

That should work.

Wilfred

[#3]

the configuration works fine

only issue is that the bind user password is not redacted in the advanced configuration snippet and in clear text in the core-site.xml

According to the security guide (sensitive data redaction), v5.8.x (not documented for 5.7.x):

Redaction of Advanced Configuration Snippet parameters is based on detecting keywords explicitly defined as sensitive in the contents of these parameters. That is, parameters containing the keywords password, key, aws, or secret, will be redacted for users who do not have the required edit privileges

I'll open a case to check how to get this working on 5.7.1