Enable LDAP Authentication for Impala to Secure User Access - E-MapReduce - Alibaba Cloud - E-MapReduce

Enabling LDAP authentication enhances service security by requiring users to provide their LDAP username and password for access. You can enable this feature from the console without complex configuration. This topic describes how to enable and disable LDAP authentication for Impala, and how to connect to Impala.

Prerequisites

You have created a cluster that runs EMR-3.44.0 or a later version, or EMR-5.10.0 or a later version, and includes the Impala and OpenLDAP cluster services. For more information, see Create a cluster.

Procedure

Go to the cluster services page.
1. Log on to the EMR on ECS console.
2. In the top navigation bar, select a region and a resource group.
3. In the Actions column of the target cluster, click Services.
Add an EMR user.
1. Click the Users tab.
2. On the Users page, click Add User.
3. In the Add User dialog box, select an existing RAM user from the Username drop-down list and enter the Password and Confirm Password.
4. Click OK.
For more information, see Add a user.
Enable LDAP authentication.
1. Click the Services tab.
2. On the Services page, click Status in the Impala service section.
3. Turn on the LDAP authentication switch.
  - For EMR-5.11.1 or later, or EMR-3.45.1 or later:
    1. In the Service Overview section, turn on the ImpalaLDAP switch.
    2. In the dialog box that appears, click OK.
  - For EMR-5.11.0 or earlier, or EMR-3.45.0 or earlier:
    1. In the Components section, find ImpalaRuntime and click enableLDAP in the Actions column.
    2. In the dialog box that appears, enter an Execution Reason and click OK.
    3. In the Confirm dialog box, click OK.
4. Restart Impala.
  1. On the Impala service page, choose More > Restart in the upper-right corner.
  2. In the dialog box that appears, enter an Execution Reason and click OK.
  3. In the Confirm dialog box, click OK.
Connect to Impala.

After you enable LDAP authentication, you must provide your LDAP credentials to connect to Impala.
1. Log on to the cluster by using SSH. For more information, see Log on to a cluster.
2. Run one of the following commands to connect to Impala.
  - impala-shell
```
impala-shell -i <impalad_node_name> -l -u <username> --auth_creds_ok_in_clear
```
  - JDBC
```
beeline -u 'jdbc:hive2://<impalad_node_name>:28000/default;transportMode=http;user=<username>;password=<password>'
```
  Note
  
  <impalad_node_name>: The name of a node that runs the Impalad daemon. On the Status tab of the Impala service page in the EMR on ECS console, find the node name in the Node name column of the Impalad topology list. For example, if the node names are core-1-1 and core-1-2, you can use either name to connect to Impala.
  
  <username> and <password>: The LDAP username and password that you created in Step 2.
Optional: Disable LDAP authentication.
1. On the Services page, click Status in the Impala service section.
2. Turn off the LDAP authentication switch.
  - For EMR-5.11.1 or later, or EMR-3.45.1 or later:
    1. In the Service Overview section, turn off the ImpalaLDAP switch.
    2. In the dialog box that appears, click OK.
  - For EMR-5.11.0 or earlier, or EMR-3.45.0 or earlier:
    1. In the Components section, find ImpalaRuntime and click disableLDAP in the Actions column.
    2. In the dialog box that appears, enter an Execution Reason and click OK.
    3. In the Confirm dialog box, click OK.
3. Restart Impala.
  1. On the Impala service page, choose More > Restart in the upper-right corner.
  2. In the dialog box that appears, enter an Execution Reason and click OK.
  3. In the Confirm dialog box, click OK.