org.apache.hadoop.security

Class LdapGroupsMapping

java.lang.Object

org.apache.hadoop.security.LdapGroupsMapping

All Implemented Interfaces:

Configurable, GroupMappingServiceProvider

@InterfaceAudience.LimitedPrivate(value={"HDFS","MapReduce"})
@InterfaceStability.Evolving
public class LdapGroupsMapping
extends Object
implements GroupMappingServiceProvider, Configurable

An implementation of GroupMappingServiceProvider which connects directly to an LDAP server for determining group membership. This provider should be used only if it is necessary to map users to groups that reside exclusively in an Active Directory or LDAP installation. The common case for a Hadoop installation will be that LDAP users and groups materialized on the Unix servers, and for an installation like that, ShellBasedUnixGroupsMapping is preferred. However, in cases where those users and groups aren't materialized in Unix, but need to be used for access control, this class may be used to communicate directly with the LDAP server. It is important to note that resolving group mappings will incur network traffic, and may cause degraded performance, although user-group mappings will be cached via the infrastructure provided by Groups. This implementation does not support configurable search limits. If a filter is used for searching users or groups which returns more results than are allowed by the server, an exception will be thrown. The implementation also does not attempt to resolve group hierarchies. In order to be considered a member of a group, the user must be an explicit member in LDAP.

Field Summary

Fields

Modifier and Type	Field and Description
static String	BASE_DN_DEFAULT
static String	BASE_DN_KEY
static String	BIND_PASSWORD_DEFAULT
static String	BIND_PASSWORD_FILE_DEFAULT
static String	BIND_PASSWORD_FILE_KEY
static String	BIND_PASSWORD_KEY
static String	BIND_USER_DEFAULT
static String	BIND_USER_KEY
static String	DIRECTORY_SEARCH_TIMEOUT
static int	DIRECTORY_SEARCH_TIMEOUT_DEFAULT
static String	GROUP_MEMBERSHIP_ATTR_DEFAULT
static String	GROUP_MEMBERSHIP_ATTR_KEY
static String	GROUP_NAME_ATTR_DEFAULT
static String	GROUP_NAME_ATTR_KEY
static String	GROUP_SEARCH_FILTER_DEFAULT
static String	GROUP_SEARCH_FILTER_KEY
static String	LDAP_CONFIG_PREFIX
static String	LDAP_KEYSTORE_DEFAULT
static String	LDAP_KEYSTORE_KEY
static String	LDAP_KEYSTORE_PASSWORD_DEFAULT
static String	LDAP_KEYSTORE_PASSWORD_FILE_DEFAULT
static String	LDAP_KEYSTORE_PASSWORD_FILE_KEY
static String	LDAP_KEYSTORE_PASSWORD_KEY
static String	LDAP_URL_DEFAULT
static String	LDAP_URL_KEY
static Boolean	LDAP_USE_SSL_DEFAULT
static String	LDAP_USE_SSL_KEY
static int	RECONNECT_RETRY_COUNT
static String	USER_SEARCH_FILTER_DEFAULT
static String	USER_SEARCH_FILTER_KEY

Constructor Summary

Constructors

Constructor and Description
LdapGroupsMapping()

Method Summary

Methods

Modifier and Type	Method and Description
void	cacheGroupsAdd(List<String> groups) Adds groups to cache, no need to do that for this provider
void	cacheGroupsRefresh() Caches groups, no need to do that for this provider
Configuration	getConf() Return the configuration used by this object.
List<String>	getGroups(String user) Returns list of groups for a user.
void	setConf(Configuration conf) Set the configuration to be used by this object.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

LDAP_CONFIG_PREFIX

public static final String LDAP_CONFIG_PREFIX

See Also:

Constant Field Values

LDAP_URL_KEY

public static final String LDAP_URL_KEY

See Also:

Constant Field Values

LDAP_URL_DEFAULT

public static final String LDAP_URL_DEFAULT

See Also:

Constant Field Values

LDAP_USE_SSL_KEY

public static final String LDAP_USE_SSL_KEY

See Also:

Constant Field Values

LDAP_USE_SSL_DEFAULT

public static final Boolean LDAP_USE_SSL_DEFAULT

LDAP_KEYSTORE_KEY

public static final String LDAP_KEYSTORE_KEY

See Also:

Constant Field Values

LDAP_KEYSTORE_DEFAULT

public static final String LDAP_KEYSTORE_DEFAULT

See Also:

Constant Field Values

LDAP_KEYSTORE_PASSWORD_KEY

public static final String LDAP_KEYSTORE_PASSWORD_KEY

See Also:

Constant Field Values

LDAP_KEYSTORE_PASSWORD_DEFAULT

public static final String LDAP_KEYSTORE_PASSWORD_DEFAULT

See Also:

Constant Field Values

LDAP_KEYSTORE_PASSWORD_FILE_KEY

public static final String LDAP_KEYSTORE_PASSWORD_FILE_KEY

See Also:

Constant Field Values

LDAP_KEYSTORE_PASSWORD_FILE_DEFAULT

public static final String LDAP_KEYSTORE_PASSWORD_FILE_DEFAULT

See Also:

Constant Field Values

BIND_USER_KEY

public static final String BIND_USER_KEY

See Also:

Constant Field Values

BIND_USER_DEFAULT

public static final String BIND_USER_DEFAULT

See Also:

Constant Field Values

BIND_PASSWORD_KEY

public static final String BIND_PASSWORD_KEY

See Also:

Constant Field Values

BIND_PASSWORD_DEFAULT

public static final String BIND_PASSWORD_DEFAULT

See Also:

Constant Field Values

BIND_PASSWORD_FILE_KEY

public static final String BIND_PASSWORD_FILE_KEY

See Also:

Constant Field Values

BIND_PASSWORD_FILE_DEFAULT

public static final String BIND_PASSWORD_FILE_DEFAULT

See Also:

Constant Field Values

BASE_DN_KEY

public static final String BASE_DN_KEY

See Also:

Constant Field Values

BASE_DN_DEFAULT

public static final String BASE_DN_DEFAULT

See Also:

Constant Field Values

USER_SEARCH_FILTER_KEY

public static final String USER_SEARCH_FILTER_KEY

See Also:

Constant Field Values

USER_SEARCH_FILTER_DEFAULT

public static final String USER_SEARCH_FILTER_DEFAULT

See Also:

Constant Field Values

GROUP_SEARCH_FILTER_KEY

public static final String GROUP_SEARCH_FILTER_KEY

See Also:

Constant Field Values

GROUP_SEARCH_FILTER_DEFAULT

public static final String GROUP_SEARCH_FILTER_DEFAULT

See Also:

Constant Field Values

GROUP_MEMBERSHIP_ATTR_KEY

public static final String GROUP_MEMBERSHIP_ATTR_KEY

See Also:

Constant Field Values

GROUP_MEMBERSHIP_ATTR_DEFAULT

public static final String GROUP_MEMBERSHIP_ATTR_DEFAULT

See Also:

Constant Field Values

GROUP_NAME_ATTR_KEY

public static final String GROUP_NAME_ATTR_KEY

See Also:

Constant Field Values

GROUP_NAME_ATTR_DEFAULT

public static final String GROUP_NAME_ATTR_DEFAULT

See Also:

Constant Field Values

DIRECTORY_SEARCH_TIMEOUT

public static final String DIRECTORY_SEARCH_TIMEOUT

See Also:

Constant Field Values

DIRECTORY_SEARCH_TIMEOUT_DEFAULT

public static final int DIRECTORY_SEARCH_TIMEOUT_DEFAULT

See Also:

Constant Field Values

RECONNECT_RETRY_COUNT

public static int RECONNECT_RETRY_COUNT

Constructor Detail

LdapGroupsMapping

public LdapGroupsMapping()

Method Detail

getGroups

public List<String> getGroups(String user)
                       throws IOException

Returns list of groups for a user. The LdapCtx which underlies the DirContext object is not thread-safe, so we need to block around this whole method. The caching infrastructure will ensure that performance stays in an acceptable range.

Specified by:

getGroups in interface GroupMappingServiceProvider

Parameters:

user - get groups for this user

Returns:

list of groups for a given user

Throws:

IOException

cacheGroupsRefresh

public void cacheGroupsRefresh()
                        throws IOException

Caches groups, no need to do that for this provider

Specified by:

cacheGroupsRefresh in interface GroupMappingServiceProvider

Throws:

IOException

cacheGroupsAdd

public void cacheGroupsAdd(List<String> groups)
                    throws IOException

Adds groups to cache, no need to do that for this provider

Specified by:

cacheGroupsAdd in interface GroupMappingServiceProvider

Parameters:

groups - unused

Throws:

IOException

getConf

public Configuration getConf()

Description copied from interface: Configurable

Return the configuration used by this object.

Specified by:

getConf in interface Configurable

setConf

public void setConf(Configuration conf)

Description copied from interface: Configurable

Set the configuration to be used by this object.

Specified by:

setConf in interface Configurable