LDAP properties

These are the properties you can use to configure LDAP for Hue in Cloudera Manager or in the hue.ini file for unmanaged clusters.

Property Name Description and Syntax
General Hue LDAP Properties
Authentication Backend

backend

Authentication Mode. Select desktop.auth.backend.LdapBackend.

Multiple backends are allowed. Create a list and add it to the Hue safety-valve.

LDAP URL

ldap_url

URL for the LDAP server.

Syntax: ldaps://<ldap_server>:<636> or ldap://<ldap_server>:<389>

Important: To prevent usernames and passwords from transmitting in the clear, use ldaps:// or ldap:// + "Enable LDAP TLS".

Create LDAP users on login

create_users_on_login

Flag to create new LDAP users at Hue login.

If true, any user who logs into Hue is automatically created. If false, only users that exist in useradmin can log in.

Direct Bind Properties
Active Directory Domain

nt_domain

For direct binding with Microsoft Active Directory only. Typically maps to the user email address or ID in conjunction with the domain. Allows Hue to authenticate without having to follow LDAP references to other partitions. Hue binds with User-Principal-Name (UPN) if provided.

Example: ad.<mycompany>.com

Important: Do not use nt_domain with LDAP Username Pattern or Search Bind.
LDAP Username Pattern

ldap_username_pattern

For direct binding with LDAP (non-Active Directory) only (because AD uses UPNs which have a space in them).

Username Pattern finds the user attempting to login into LDAP by adding the username to a predefined DN string. Use <username> to reference the user logging in. An example is "uid=<username>,ou=people,dc=mycompany,dc=com".

Search Bind Properties
Use Search Bind Authentication

search_bind_authentication

Flag to enable/disable Search Bind.
LDAP Search Base

base_dn

Distinguished name to use as a search base for finding users and groups.

Syntax: dc=ad, dc=sec, dc=mycompany,dc=com

Encryption Properties
LDAP Server CA Certificate

ldap_cert

Full path to .pem file with Certificate Authority (CA) chain used to sign the LDAP server certificate.

If left blank, all certificates are trusted and otherwise encrypted usernames and passwords are vulnerable to attack.

Enable LDAP TLS

use_start_tls

Flag to enable/disable encryption with the StartTLS operation.
Import / Sync Properties
LDAP Bind User Distinguished Name

bind_dn

Bind user. Only use if LDAP/AD does not support anonymous binds. (Typically, LDAP supports anonymous binds and AD does not.) Bind User differs per auth type:

  • Search Bind: username@domain
  • Direct Bind with NT Domain: username
  • Direct Bind with Username Pattern: DN string (and same as LDAP Username Pattern)
LDAP Bind Password

bind_password

Bind user password.
Filter Properties
LDAP User Filter

user_filter

General LDAP text search filter to restrict search of valid users. Only used by Search Bind authentication and LDAP Sync.

The default is objectclass=* but can differ. For example, some LDAP environments support Posix objects for *nix authentication and the user filter might need to be objectclass=posixAccount.

LDAP Username Attribute

user_name_attr

Username to search against (the attribute in LDAP that contains the username).

Typical attributes include sAMAccountName (default for AD/LDAP) and uid (LDAP default).

Maintain case sensitivity when setting attributes for AD/LDAP.

LDAP Group Filter

group_filter

General LDAP text search filter to restrict search of valid groups. Only used by LDAP Sync (not authentication). If left blank, no filtering is used and all groups in LDAP are synced.

The default is objectclass=* but can differ. For example, some LDAP environments support Posix objects for *nix authentication and the user filter might need to be objectclass=posixGroup.

LDAP Group Name Attribute

group_name_attr

Group name to search against (the attribute in LDAP that contains the groupname).

If left blank, the default is "cn" (common name), that typically works with AD/LDAP.

Maintain case sensitivity when setting attributes for AD/LDAP.

LDAP Group Membership Attribute

group_member_attr

Attribute in the group that contains DNs of all the members.(Optional) -

If left blank, the default is "memberOf" or "member", that typically works with Active Directory/LDAP.

Test Properties
LDAP Username for Test LDAP Configuration

test_ldap_user

Any user (ideally with low privileges) used to verify the LDAP configuration.
LDAP Group Name for Test LDAP Configuration

test_ldap_group

Any group (and not necessarily one that includes the test user) used to verify the LDAP configuration.