hdfs集成ldap

隶属于文章系列：大数据安全实战 https://www.jianshu.com/p/76627fd8399c

---

修改hdfs-site.xml

/var/opt/hadoop-2.7.4/etc/hadoop/hdfs-site.xml

 

hadoop.security.group.mapping
org.apache.hadoop.security.LdapGroupsMapping



hadoop.security.group.mapping.ldap.url
ldap://172.20.176.171



hadoop.security.group.mapping.ldap.bind.user
uid=ldapadmin,ou=people,dc=javachen,dc=com



hadoop.security.group.mapping.ldap.bind.password
secret



hadoop.security.group.mapping.ldap.base
dc=javachen,dc=com



hadoop.security.group.mapping.ldap.search.filter.user
(&(objectClass=account)(uid={0}))



hadoop.security.group.mapping.ldap.search.filter.group
(objectClass=groupOfNames)



hadoop.security.group.mapping.ldap.search.attr.member
member



hadoop.security.group.mapping.ldap.search.attr.group.name
cn

 

注意：

• nn1 nn2的hdfs-site.xml不一样

生效

[hadoop@vm10-247-24-53 ~]$ hdfs dfsadmin  -refreshUserToGroupsMappings
Refresh user to groups mapping successful for vm10-247-24-53.ksc.com/10.247.24.53:8020
Refresh user to groups mapping successful for vm10-247-24-54.ksc.com/10.247.24.54:8020
[hadoop@vm10-247-24-53 ~]$

或者重启

验证

[hadoop@vm10-247-24-53 kduser]$ hdfs groups
hadoop : admin