[
https://issues.apache.org/jira/browse/HIVE-14513?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15431190#comment-15431190
]
Naveen Gangam commented on HIVE-14513:
--------------------------------------
Thanks for the review [~leftylev]. So with "represents" I meant to indicate
that the value for that hive property maps to the attribute name (on the LDAP
entries). If there is a better means to express it, please feel free to change
it. Thank you again.
> Enhance custom query feature in LDAP atn to support resultset of ldap groups
> ----------------------------------------------------------------------------
>
> Key: HIVE-14513
> URL: https://issues.apache.org/jira/browse/HIVE-14513
> Project: Hive
> Issue Type: Bug
> Components: HiveServer2
> Affects Versions: 1.0.0
> Reporter: Naveen Gangam
> Assignee: Naveen Gangam
> Fix For: 2.2.0, 2.1.1
>
> Attachments: HIVE-14513.patch
>
>
> LDAP Authenticator can be configured to use a result set from a LDAP query to
> authenticate. However, is it expected that this LDAP query would only result
> a set of users (aka full DNs for the users in LDAP).
> However, its not always straightforward to be able to author queries that
> return users. For example, say you would like to allow "all users from group1
> and group2" to be authenticated. The LDAP query has to return a union of all
> members of the group1 and group2.
> For example, one common configuration is that groups contain a list of its
> users
> "dn: uid=group1,ou=Groups,dc=example,dc=com",
> "distinguishedName: uid=group1,ou=Groups,dc=example,dc=com",
> "objectClass: top",
> "objectClass: groupOfNames",
> "objectClass: ExtensibleObject",
> "cn: group1",
> "ou: Groups",
> "sn: group1",
> "member: uid=user1,ou=People,dc=example,dc=com",
> The query
> {{(&(objectClass=groupOfNames)(|(cn=group1)(cn=group2)))}}
> will return the entries
> uid=group1,ou=Groups,dc=example,dc=com
> uid=group2,ou=Groups,dc=example,dc=com
> but there is no means to form a query that would return just the values of
> "member" attributes. (ldap client tools are able to do by filtering out the
> attributes on these entries.
> So it will be useful to have such support to be able to specify queries that
> return groups.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
