Configuring Hadoop Group Mappings for LDAP/Active Directory

To set up the mappings all at one time, run the following on un0:

1. On the un0, run the following:

   export AMBARI_CONF_SCRIPT=/var/lib/ambari-server/resources/scripts/configs.py

2. Collect the <ambari_password>, <un0_node_IP>, and <cluster_name> (check your cluster name from Ambari UI), and then run the following to get the current core-site configuration.

   python ${AMBARI_CONF_SCRIPT} \
   --user=admin \
   --password='<ambari_password>' \
   --protocol=https --unsafe \
   --host=<un0_node_IP> \
   --port=7183 \
   --cluster=<cluster_name> \
   --config-type=core-site \
   --action=get \
   --file=/tmp/current_core-site.json

3. Paste the key-value pairs with the appropriate values into the properties object key-value series of your config JSON file current_core-site.json, and then add the following key-value pair to the password object of properties_attributes object.

   "password": {
      "hadoop.security.group.mapping.provider.ad4usersX.ldap.bind.password": "true" //the key-value pair to mask out your password in Ambari.
    },

4. Run the following to update the configuration:

   python ${AMBARI_CONF_SCRIPT} \
   --user=admin \
   --password='<ambari_password>' \
   --protocol=https --unsafe \
   --host=<un0_node_IP> \
   --port=7183 \
   --cluster=<cluster_name> \
   --config-type=core-site \
   --action=set \
   --file=/tmp/current_core-site.json

5. By default, Hadoop refreshes the user-group mapping cache every 300 seconds. To have a smaller refresh interval, add the following key-value pair:

   "hadoop.security.groups.cache.secs":"<number of seconds you need>"

6. Click the Services '...' icon, and then click Restart all required.