0

I am trying to setup openLDAP for users to groups mapping for hadoop 2.7.1, guess something wrong in the way i have defined the groups or applying the filters. Its able to connect to the server but throws invalid DN and returns with no groups.

My LDIF export ->

# Entry 1: ou=groups,dc=ubu,dc=com
dn: ou=groups,dc=ubu,dc=com
objectclass: organizationalUnit
objectclass: top
ou: groups

# Entry 2: cn=admin,ou=groups,dc=ubu,dc=com
dn: cn=admin,ou=groups,dc=ubu,dc=com
cn: admin
gidnumber: 500
memberuid: meadmin
objectclass: posixGroup
objectclass: top

# Entry 3: cn=operator,ou=groups,dc=ubu,dc=com
dn: cn=operator,ou=groups,dc=ubu,dc=com
cn: operator
gidnumber: 501
memberuid: meoperator
objectclass: posixGroup
objectclass: top

# Entry 4: cn=user,ou=groups,dc=ubu,dc=com
dn: cn=user,ou=groups,dc=ubu,dc=com
cn: user
gidnumber: 502
memberuid: meuser
memberuid: meuser2
objectclass: posixGroup
objectclass: top

# Entry 5: ou=users,dc=ubu,dc=com
dn: ou=users,dc=ubu,dc=com
objectclass: organizationalUnit
objectclass: top
ou: users

# Entry 6: cn=hadmin1,ou=users,dc=ubu,dc=com
dn: cn=hadmin1,ou=users,dc=ubu,dc=com
cn:  hadmin1
gidnumber: 500
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: top
sn: meadmin
uid: meadmin
uidnumber: 1000

# Entry 7: cn=hoperator1,ou=users,dc=ubu,dc=com
dn: cn=hoperator1,ou=users,dc=ubu,dc=com
cn: hoperator1
gidnumber: 501
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: top
sn: meoperator
uid: meoperator
uidnumber: 1002

# Entry 8: cn=huser1,ou=users,dc=ubu,dc=com
dn: cn=huser1,ou=users,dc=ubu,dc=com
cn:  huser1
gidnumber: 502
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: top
sn: meuser
uid: meuser
uidnumber: 1001

# Entry 9: cn=tester1,ou=users,dc=ubu,dc=com
dn: cn=tester1,ou=users,dc=ubu,dc=com
cn:  tester1
gidnumber: 502
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: top
sn: meuser2
uid: meuser2
uidnumber: 1003

Core-site ldap mapping ->

<property>
<name>hadoop.security.group.mapping.ldap.search.filter.user</name>
<value>(&amp;(objectClass=inetOrgPerson)(uid={0}))</value>
</property>

<property>
<name>hadoop.security.group.mapping.ldap.search.filter.group</name>
<value>(objectClass=groupOfNames)</value>
</property>

<property>
<name>hadoop.security.group.mapping.ldap.search.attr.member</name>
<value>member</value>
</property>

<property>
<name>hadoop.security.group.mapping.ldap.search.attr.group.name</name>
<value>cn</value>
</property>

What am i missing?

meer
  • 119
  • 5

1 Answers1

0

Try the following alternatives for filter.group and attr.member. You're using the wrong objectClass for the group and the wrong attribute for members.

<property>
<name>hadoop.security.group.mapping.ldap.search.filter.group</name>
<value>(objectClass=posixGroup)</value>
</property>

<property>
<name>hadoop.security.group.mapping.ldap.search.attr.member</name>
<value>memberuid</value>
</property>
Liam Gretton
  • 370
  • 1
  • 8