User authentication in Hue

Cloudera services do not authenticate each user that logs in to Hue. The Cloudera services authenticate Hue and trust that Hue has authenticated its users. In a most typical configuration, Hue users can be authenticated with an LDAP server and the Cloudera users can be authenticated with Kerberos. You can also use SAML for Single Sign-on (SSO) authentication.

After Hue is authenticated by a service such as Hive, Hue impersonates the user requesting the use of that service, for example, to create a Hive table. In this case, the Hive service uses Apache Ranger to ensure that the group to which the user belonged is authorized for that action (to create a Hive table).