For the benefit of others reading this thread, I managed to get an answer via our Oracle (Big Data Appliance) support agreement, who in-turn asked Cloudera for the answer. Here's the response (edited);   "1. Hue only gets group membership from its internal DB. Rather than manually adding users, Hue can import users & groups from LDAP. Also the LDAP group membership is updated when the sync users/groups is run. This section of the documentation describes common configurations: http://www.cloudera.com/content/cloudera-content/cloudera-docs/CDH5/latest/CDH5-Security-Guide/cdh5sg_hue_ldap_config.html   Below are a few blogs that explain some of the details.   How-to: Make Hadoop Accessible via LDAP http://blog.cloudera.com/blog/2014/02/how-to-make-hadoop-accessible-via-ldap/   How-to: Manage Permissions in Hue http://blog.cloudera.com/blog/2012/12/managing-permissions-in-hue/   2. Currently there is no way to limit users login based on group. The sync process only brings in users already defined for Hue. You can import users from and LDAP by defining a user filter. The process is described in the blog " How-to: Make Hadoop Accessible via LDAP". Cloudera opened a feature request for you just now, to limit user logins by group membership. It is being tracked by internal JIRA CDH-20336.    3. However you can add useradmin rights to a particular group. To do this you navigate to User Admin (icon in menu bar) -> permissions (tab). In that screen you can define a group that has admin privileges."   Mark ... View more