E-MapReduce:Manage LDAP authentication

Considerations

• If you cannot connect to the cluster after you enable LDAP authentication on EMR-3.43.1 or EMR-5.9.1, the issue may be caused by a missing configuration on worker nodes. To resolve this issue, log on to the master-1-1 node and find the internal-communication.shared-secret parameter and its value in the Presto config.properties file. Then, in the EMR console, add this configuration to the core and task node groups. For more information about how to add a configuration item, see Add configuration items.

• For Trino, LDAP authentication and Kerberos are mutually exclusive. You can enable only one at a time.

Procedure

1. Add an EMR user. For more information, see Add a user.

2. Go to the Services tab.

   1. Log on to the EMR console.

   2. In the left-side navigation pane, click EMR on ECS.

   3. In the top navigation bar, select the region in which your cluster resides and select a resource group based on your business requirements.

   4. On the EMR on ECS page, find the desired cluster and click Services in the Actions column.

3. Enable LDAP authentication.

   1. On the Services page, find the Trino service and click Status.

   2. Enable LDAP for the Trino service.

      • For EMR-5.11.1 or later and EMR-3.45.1 or later:

        1. In the Service Overview section, turn on the TrinoLDAP switch.

        2. In the dialog box that appears, click OK.

      • For EMR-5.11.0 or earlier and EMR-3.45.0 or earlier:

        Important

        If your EMR cluster is of an earlier version in which no switch is available to enable LDAP authentication, you need to manually configure settings to enable LADP authentication by referring to the documentation of open source Spark in the community.

        1. In the Components section, find TrinoMaster and in the Actions column, select .

        2. In the dialog box that appears, enter an Execution Reason and click OK.

        3. In the Confirm dialog box, click OK.

   3. Restart TrinoMaster.

      1. In the Components section, find TrinoMaster and click restart in the Actions column.

      2. In the dialog box that appears, enter an Execution Reason and click OK.

      3. In the Confirm dialog box, click OK.

4. Connect to the Trino service.

   After enabling LDAP authentication, you must use LDAP credentials to access Trino.

   1. Connect to the cluster over SSH. For more information, see Log on to a cluster.

   2. Run the following command to access Trino.

      Important

      After high security is enabled, you can access Trino only over HTTPS. Port 9090 is disabled, and the http-server.http.port parameter is ignored. Therefore, you must use port 7778 to access Trino.

      trino --server https://{fqdn}:7778 --keystore-path {keystore_location} \
      --keystore-password {keystore_passwd} --catalog hive --user {user} --password

      Parameter	Description
      {fqdn}	The fully qualified domain name (FQDN) of the Trino coordinator node. In the EMR console, go to the Configure tab of the Trino service. Select Dedicated configuration node and master-1-1. Then, find the ldap.url parameter to obtain the FQDN, which is in the format master-1-1.c-xxxxxxx.cn-x******.emr.aliyuncs.com.
      {keystore_location}	The path of the keystore. This is the value of http-server.https.keystore.path in the config.properties file. The value is /etc/emr/trino-conf/keystore.
      {keystore_passwd}	The password of the keystore. This is the value of http-server.https.keystore.key in the config.properties file. To obtain the value, run the following command on the master-1-1 node: awk -F= '/http-server.https.keystore.key/{print $2}' ${TRINO_CONF_DIR}/config.properties
      {user}	The LDAP username. This is the username that you added in Step 1.

      After you run the command, enter the password when prompted. This is the LDAP password that you set for the user in Step 1.

5. Optional: Disable LDAP authentication.

   1. On the Services page, find the Trino service and click Status.

   2. Disable LDAP for the Trino service.

      • For EMR-5.11.1 or later and EMR-3.45.1 or later:

        1. In the Service Overview section, turn off the TrinoLDAP switch.

        2. In the dialog box that appears, click OK.

      • For EMR-5.11.0 or earlier and EMR-3.45.0 or earlier:

        1. In the Components section, find TrinoMaster and in the Actions column, select .

        2. In the dialog box that appears, enter an Execution Reason and click OK.

        3. In the Confirm dialog box, click OK.

   3. Restart TrinoMaster.

      1. In the Components section, find TrinoMaster and click restart in the Actions column.

      2. In the dialog box that appears, enter an Execution Reason and click OK.

      3. In the Confirm dialog box, click OK.