Support Questions
Find answers, ask questions, and share your expertise

Why can't we use LDAP for Hadoop authentication?

We all know that Hadoop needs Kerberos to be fully secure. LDAP is an authentication solution used with several Hadoop tools (Ambari, Nifi, Ambari, etc). Why we need Kerberos in addition of LDAP ?

1 ACCEPTED SOLUTION

Accepted Solutions

Re: Why can't we use LDAP for Hadoop authentication?

You can use LDAP in ADDITION to Kerberos. LDAP is the authentication authority. Kerberos is the ticketing system. LDAP is like the DMV giving you your driver's licence. Kerberos is your boarding pass to get on the plane. Kerberos can be enabled with AD, FreeIPA as your LDAP in HAdoop. Ambari, Nifi, Ranger will authenticate with those LDAPs. The only exception is Hive where when Kerberos is enabled it replaces LDAP authentication.

View solution in original post

3 REPLIES 3

Re: Why can't we use LDAP for Hadoop authentication?

Here is your answer: You can easily spoof your Hadoop cluster with a change of a simple environment variable.

7536-1-spoof-security.gif

See also

https://community.hortonworks.com/questions/2982/kerberos-adldap-and-ranger.html

Re: Why can't we use LDAP for Hadoop authentication?

@Ancil McBarnett

Thanks, I am already aware of this. My question is more on why we can not use LDAP ? is it because Hadoop doesn't support it and we can some day implement and LDAP integration ? or because LDAP is lacking a feature, hence can not and will never replace Kerberos ?

Re: Why can't we use LDAP for Hadoop authentication?

You can use LDAP in ADDITION to Kerberos. LDAP is the authentication authority. Kerberos is the ticketing system. LDAP is like the DMV giving you your driver's licence. Kerberos is your boarding pass to get on the plane. Kerberos can be enabled with AD, FreeIPA as your LDAP in HAdoop. Ambari, Nifi, Ranger will authenticate with those LDAPs. The only exception is Hive where when Kerberos is enabled it replaces LDAP authentication.

View solution in original post