Why can't we use LDAP for Hadoop authentication?

[#1]

We all know that Hadoop needs Kerberos to be fully secure. LDAP is an authentication solution used with several Hadoop tools (Ambari, Nifi, Ambari, etc). Why we need Kerberos in addition of LDAP ?

[#2]

Here is your answer: You can easily spoof your Hadoop cluster with a change of a simple environment variable.

See also

https://community.hortonworks.com/questions/2982/kerberos-adldap-and-ranger.html

[#3]

@Ancil McBarnett

Thanks, I am already aware of this. My question is more on why we can not use LDAP ? is it because Hadoop doesn't support it and we can some day implement and LDAP integration ? or because LDAP is lacking a feature, hence can not and will never replace Kerberos ?

[#4 · Accepted solution]

You can use LDAP in ADDITION to Kerberos. LDAP is the authentication authority. Kerberos is the ticketing system. LDAP is like the DMV giving you your driver's licence. Kerberos is your boarding pass to get on the plane. Kerberos can be enabled with AD, FreeIPA as your LDAP in HAdoop. Ambari, Nifi, Ranger will authenticate with those LDAPs. The only exception is Hive where when Kerberos is enabled it replaces LDAP authentication.