Sentry配置

Hive（服務(wù)范圍）下 hive.sentry.provider配置為默認(rèn)值 
org.apache.sentry.provider.file.HadoopGroupResourceAuthorizationProvider

hue配置

backend = desktop.auth.backend.LdapBackend
ldap_url = ldap://master


使用搜索綁定身份驗(yàn)證search_bind_authentication = true
LDAP 搜索基礎(chǔ)base_dn:  dc=ohkj,dc=com
LDAP 綁定用戶可分辨名稱bind_dn:  uid=ldapadmin,ou=people,dc=ohkj,dc=com
LDAP 綁定密碼bind_password = ${BIND_PASSWORD}
LDAP User Filter = (objectClass=posixAccount)
LDAP user_name_attr = uid
LDAP group_filter = (objectClass=posixGroup)
LDAP group_name_attr = cn
LDAP group_member_attr = memberUID

sentry服務(wù)：Sentry

hue的配置中搜索：sqoop
sqoop服務(wù)選擇sqoop2

hive配置

hive-site.xml 的 HiveServer2 高級(jí)配置代碼段（安全閥）
添加如下配置：

<property>
  <name>hive.server2.authentication</name>
  <value>LDAP</value>
</property>
<property>
  <name>hive.server2.authentication.ldap.url</name>
  <value>ldap://master</value>
</property>
<property>
  <name>hive.server2.authentication.ldap.baseDN</name>
  <value>ou=people,dc=0hkj,dc=com</value>
</property>
**********************************************************************************************************************************
在CM上轉(zhuǎn)入Hive的配置頁面：

取消勾選 HiveServer2 啟用模擬
設(shè)置Sentry 服務(wù)屬性為 Sentry
CDH中只需要配置上面兩項(xiàng)即可，其余配置文件CDH會(huì)自動(dòng)配置好。

HDFS配置

Hadoop 用戶組映射實(shí)現(xiàn) 
hadoop.security.group.mapping 

org.apache.hadoop.security.LdapGroupsMapping
----------------------------------------------------------------
Hadoop 用戶組 進(jìn)程ping LDAP URL 
hadoop.security.group.mapping.ldap.url

ldap://master
----------------------------------------------------------------
Hadoop 用戶組映射 LDAP 綁定用戶可分辨名稱
hadoop.security.group.mapping.ldap.bind.user

uid=ldapadmin,ou=people,dc=sunmnet,dc=com
----------------------------------------------------------------
Hadoop 用戶組 進(jìn)程ping 搜索基礎(chǔ)
hadoop.security.group.mapping.ldap.base

dc=sunmnet,dc=com
----------------------------------------------------------------
Hadoop 用戶組 進(jìn)程ping LDAP 用戶搜索篩選器
hadoop.security.group.mapping.ldap.search.filter.user

(&(objectClass=posixAccount)(uid={0}))
-----------------------------------------------------------------
Hadoop 用戶組 進(jìn)程ping LDAP 組搜索篩選器
hadoop.security.group.mapping.ldap.search.filter.group

(objectClass=posixGroup)
-----------------------------------------------------------------
Hadoop 用戶組 進(jìn)程ping LDAP 組成員身份屬性
hadoop.security.group.mapping.ldap.search.attr.member

memberUid
-----------------------------------------------------------------
Hadoop 用戶組 進(jìn)程ping LDAP 組名稱屬性
hadoop.security.group.mapping.ldap.search.attr.group.name

cn
-----------------------------------------------------------------
Hadoop 用戶組 進(jìn)程ping LDAP 綁定用戶密碼
hadoop.security.group.mapping.ldap.bind.password

${BIND_PASSWORD}