隶属于文章系列:大数据安全实战 https://www.jianshu.com/p/76627fd8399c
修改hdfs-site.xml
/var/opt/hadoop-2.7.4/etc/hadoop/hdfs-site.xml
<!-- openldap start -->
<property>
<name>hadoop.security.group.mapping</name>
<value>org.apache.hadoop.security.LdapGroupsMapping</value>
</property>
<property>
<name>hadoop.security.group.mapping.ldap.url</name>
<value>ldap://172.20.176.171</value>
</property>
<property>
<name>hadoop.security.group.mapping.ldap.bind.user</name>
<value>uid=ldapadmin,ou=people,dc=javachen,dc=com</value>
</property>
<property>
<name>hadoop.security.group.mapping.ldap.bind.password</name>
<value>secret</value>
</property>
<property>
<name>hadoop.security.group.mapping.ldap.base</name>
<value>dc=javachen,dc=com</value>
</property>
<property>
<name>hadoop.security.group.mapping.ldap.search.filter.user</name>
<value>(&(objectClass=account)(uid={0}))</value>
</property>
<property>
<name>hadoop.security.group.mapping.ldap.search.filter.group</name>
<value>(objectClass=groupOfNames)</value>
</property>
<property>
<name>hadoop.security.group.mapping.ldap.search.attr.member</name>
<value>member</value>
</property>
<property>
<name>hadoop.security.group.mapping.ldap.search.attr.group.name</name>
<value>cn</value>
</property>
<!-- openldap end -->
注意:
- nn1 nn2的hdfs-site.xml不一样
生效
[hadoop@vm10-247-24-53 ~]$ hdfs dfsadmin -refreshUserToGroupsMappings
Refresh user to groups mapping successful for vm10-247-24-53.ksc.com/10.247.24.53:8020
Refresh user to groups mapping successful for vm10-247-24-54.ksc.com/10.247.24.54:8020
[hadoop@vm10-247-24-53 ~]$
或者重启
验证
[hadoop@vm10-247-24-53 kduser]$ hdfs groups
hadoop : admin