About Timothy

Timothy · ‎01-10-2019

Does anyone know what are the changes we need to use the https://issues.cloudera.org/browse/HUE-7407 changed code effectively. We have in our user_filter: |(memberof=CN=admin_group,OU=OUname,DC=DC,DC=DC,DC=com)(memberof=CN=nonadmin_group,OU=OUname,DC=DC,DC=DC,DC=com) Ideally we want to someway set all the poeple in the admin group as super_user's for hue.It would be of great help because currently when we rehydrate our AWS EMR which has HUE enabled all the user's gets removed and when someone logins to the new AWS EMR they will become super_user.I have circumvented this issue temporarly by login a user in the bootstrap action.

Timothy · ‎11-16-2018

@bgooley @Tomas79 I ended up loging in a user when the EMR is launching in the bootstrap action.I did this via curl commands.This will avoid any user being given super user status. For anyone needing guidance on the workaround you could follow the below steps. 1) Curl command to get the cookie.txt(it has the session id and csrf token) file. 2) Curl command to login(You have to grep from the cookie.txt file the session id and csrftoken) If anyone has a better idea please let me know

Timothy · ‎11-09-2018

@Tomas79 When you say security I am guessing regarding the login's. We currently are securing the authentication by limiting the users to only certain AD groups in the user_filter section in hue.ini. The issue we are having is with first user that logins after the EMR is launched is being given superuser status.I want the super user status to be given to only members of a certain admin AD group.

Timothy · ‎11-09-2018

@bgooley Regarding "Rehydrate our EMR the Superuser is no longer in the system" We launch our EMR on AWS via CLoud Formation Template(CFT).Hue is enabled on our EMR.We delete our CFT every two months or so which tears down our EMR which has HUE enabled and rehydrate a new EMR with HUE enabled.Whatever user data we had in the old EMR is deleted now.This causes the problem where the first user who logins become the superuser.We where wondering if we can add a filter like the user_filter or another work around to avoid this situation.

Timothy · ‎11-08-2018

Thank you for your response. So what would be best option to solve this issue.When we rehydrate our EMR the Superuser is no longer in the system. Currently I login before anyone logins to avoid giving access to people who shouldnt have access.Also what do we need to do to get the 6.1 update when it is up. Curently user_filter=(|(memberof=CN=admingroup,OU=ouname,DC=stuff,DC=stuff1,DC=stuff2,DC=stuff3) (memberof=CN=nonadmingroup,OU=ouname,DC=stuff,DC=stuff1,DC=stuff2,DC=stuff3)), user_name_attr=cn NO FILTERS IN GROUP This will only give access to people in those AD groups.I want the admingroup get superuser access.

Timothy · ‎11-07-2018

We recently were trying to integrate HUE on our EMR by authenticating via LDAP authentication. Based on the documentation on HUE the first user that logins will become the superuser.Our end goal is to make members of a Active Directory group super users.Having any first user being the super user makes the emr vulnerable and can give superuser access to people who shouldnt have super user access.How can we add a filter in hue.ini file or any file that will give superuser access to only members of a active directory group.

Timothy · ‎11-07-2018

Would it be possible to set people who are members of a Active Directory group as super user? i want this to be automated when users login. In enterprise versions that are on AWS emr it is a vulnerabiltiy that the first user is the superuser.

Online	Offline
Last Visited	‎02-04-2019 10:08 AM

Member Since	‎11-07-2018 11:38 AM
Last Visited	‎02-04-2019 10:08 AM
Posts	10

Cloudera Community

Re: Urgent:HUE LDAP Super User Issue

Urgent:Hue 4.3.0 upgrade super_user issue

Re: Urgent:HUE LDAP Super User Issue

Re: Urgent:HUE LDAP Super User Issue

Re: Urgent:HUE LDAP Super User Issue

Re: Urgent:HUE LDAP Super User Issue

Urgent:HUE LDAP Super User Issue

Re: Hue web default username?