All Products
Search

This Product

    E-MapReduce:Manage LDAP authentication

    Document Center

    E-MapReduce:Manage LDAP authentication

    Last Updated:Aug 20, 2026

    After you enable Lightweight Directory Access Protocol (LDAP) authentication, you must provide an LDAP username and password to access the service, which enhances its security. EMR lets you enable LDAP authentication with a single click, eliminating complex configuration. This topic describes how to enable LDAP authentication for the Presto service and how to connect to it.

    Prerequisites

    A cluster with the Presto and OpenLDAP services is required. For more information, see Create a cluster.

    Notes

    • This feature is available only for common clusters. LDAP authentication is not supported on high-security clusters.

    • For earlier EMR versions that lack a dedicated button, you must configure LDAP authentication manually. For more information, refer to the relevant open-source documentation.

    Steps

    1. Add an EMR user.

      1. Log on to the EMR on ECS console.

      2. In the top navigation bar, select a region and resource group.

      3. Find the target cluster and click Nodes in the Actions column.

      4. Click the Users tab.

      5. Add a user. For more information, see Add a user.

    2. Enable LDAP authentication.

      1. Click the Services tab.

      2. On the Services page, find the Presto service and click Status.

      3. In the Service Overview section, turn on the PrestoLDAP switch.

      4. In the dialog box, click OK.

      5. Restart PrestoMaster.

        1. In the Components section, find PrestoMaster and click Restart in the Actions column.

        2. In the dialog box, enter a reason in the Execution Reason field and click OK.

        3. In the Confirm dialog box, click OK.

    3. Connect to the Presto service.

      After enabling LDAP authentication, you must provide LDAP credentials to access Presto.

      1. Log on to the cluster using SSH. For more information, see Log on to a cluster.

      2. Run the following command to access Presto.

        Important

        After enabling LDAP authentication, Presto is accessible only over HTTPS on port 7779. The HTTP port 8889 is disabled, and the UI is no longer accessible at its previous address. This is because the http-server.http.port is overridden by the http-server.https.port setting.

        presto --server https://{fqdn}:7779 --keystore-path {keystore_location} \
--keystore-password {keystore_passwd} --catalog hive --user {user} --password

        Parameter

        Description

        {fqdn}

        The FQDN of the master-1-1 node. You can run the hostname -f command to obtain the FQDN. The FQDN is in the master-1-1.c-xxxxxxx.cn-xxxxxx.emr.aliyuncs.com format.

        {keystore_location}

        The path to the keystore file.

        This is the value of http-server.https.keystore.path in the config.properties file. The path is always /etc/emr/presto-conf/keystore.

        {keystore_passwd}

        The password for the keystore.

        This is the value of http-server.https.keystore.key in the config.properties file. To obtain the password, run the awk -F= '/http-server.https.keystore.key/{print $2}' ${PRESTO_CONF_DIR}/config.properties command on the master-1-1 node.

        {user}

        The LDAP username. This is the username you added in Step 1.

        After you run the command, enter the password when prompted. Use the password you set for the LDAP user in Step 1.

    4. (Optional) Disable LDAP authentication.

      1. In the Service Overview section of the Presto service, turn off the PrestoLDAP switch.

      2. In the dialog box, click OK.

      3. Restart PrestoMaster.

        1. In the Components section, find PrestoMaster and click Restart in the Actions column.

        2. In the dialog box, enter a reason in the Execution Reason field and click OK.

        3. In the Confirm dialog box, click OK.