All Products
Search

This Product

    E-MapReduce:Use LDAP authentication

    Document Center

    E-MapReduce:Use LDAP authentication

    Last Updated:Jun 21, 2026

    After LDAP authentication is enabled for a service, you must provide your LDAP username and password when you access the service. This improves the security of the service. You can enable LDAP authentication for a service in the EMR console by performing simple operations. This frees you from the complex configuration of LDAP authentication.

    Prerequisites

    You have created a DataLake cluster or a custom cluster with the Hive and OpenLDAP components selected. For more information, see Create a cluster.

    Enable LDAP authentication with one click

    1. Add an EMR user. For more information, see Add a user.

    2. Go to the Services tab.

      1. Log on to the EMR console.

      2. In the left-side navigation pane, click EMR on ECS.

      3. In the top navigation bar, select the region in which your cluster resides and select a resource group based on your business requirements.

      4. On the EMR on ECS page, find the desired cluster and click Services in the Actions column.

    3. Enable LDAP authentication.

      1. On the Services page, click Status in the Hive service section.

      2. Turn on the enableLDAP switch.

        • For EMR 5.11.1 or later and EMR 3.45.1 or later

          1. In the Service Overview section, turn on the enableLDAP switch.

          2. In the dialog box that appears, click OK.

        • For EMR 5.11.0 or earlier and EMR 3.45.0 or earlier

          1. In the Components section, find HiveServer and choose more > enableLDAP in the Actions column.

          2. In the dialog box that appears, enter an Execution Reason and click OK.

          3. In the Confirm dialog box, click OK.

      3. Restart HiveServer.

        1. In the Components section, find HiveServer and click Restart in the Actions column.

        2. In the dialog box that appears, enter an Execution Reason and click OK.

        3. In the Confirm dialog box, click OK.

    4. Connect to HiveServer.

      After enabling LDAP authentication, you must use LDAP credentials to connect to HiveServer2.

      1. Log on to the cluster over SSH. For more information, see Log on to a cluster.

      2. Run the following command to connect to HiveServer2.

        • Beeline client:

          beeline -u jdbc:hive2://master-1-1:10000 -n <user> -p <password>

        • JDBC:

          jdbc:hive2://master-1-1:10000/default;user=<user>;password=<password>
        Note

        <user> and <password> are the username and password for the user that you added in Step 1.

    Manually configure LDAP authentication

    The EMR console provides an enableLDAP button that allows you to enable LDAP authentication with one click. If you use an earlier version of EMR or want to connect to a self-managed LDAP service, you must manually configure LDAP authentication for HiveServer2.

    On the Configure page of the Hive service in the EMR console, go to the hiveserver2-site.xml tab and add the following configuration items. For more information about how to add a configuration item, see Manage configuration items.

    Parameter

    Value

    Description

    hive.server2.authentication

    LDAP

    Specifies the authentication method for HiveServer2.

    hive.server2.authentication.ldap.url

    ldap://{ldap_hostname}:{port}

    Example: ldap://master-1-1:10389

    The connection URL for the LDAP service. This value depends on your environment.

    • {ldap_hostname}: The hostname or IP address of the LDAP service. If you connect to the LDAP service of an EMR cluster, the value is typically emr-header-1.

    • The LDAP service port. The default port for the EMR LDAP service is 10389. For self-managed LDAP services, use the port specific to your environment.

    hive.server2.authentication.ldap.baseDN

    ou=people,o=emr

    The base distinguished name (DN) for users. For the EMR LDAP service, the value is ou=people,o=emr. For self-managed LDAP services, use the base DN from your environment.

    Restrict access to specific users or groups

    After enabling LDAP authentication for the Hive service, you can add or modify the following configurations to restrict access to specific users.

    Configuration

    1. On the Configure page of the Hive service in the EMR console, go to the hiveserver2-site.xml tab, and add or modify the following configuration items.

      Parameter

      Example value

      Actions

      Description

      hive.server2.authentication.ldap.userDNPattern

      uid=%s,ou=people,o=emr

      Add

      The user DN pattern that defines the search path for users in LDAP. %s is replaced with the actual username.

      hive.server2.authentication.ldap.groupFilter

      username

      Add

      A comma-separated list of groups. Only users who belong to these groups can access HiveServer2.

      hive.server2.authentication.ldap.groupClassKey

      posixGroup

      Add

      The value of the objectClass attribute that indicates a group object in LDAP.

      hive.server2.authentication.ldap.groupMembershipKey

      memberUid

      Add

      The attribute name that is used to store member information in an LDAP group object.

      hive.server2.authentication.ldap.baseDN

      o=emr

      Modify

      The base DN for LDAP searches. Modify the existing value to a base path that works for group filtering.

    2. Save the new and modified configurations.

    3. Restart the HiveServer2 service to apply the new configuration.

    Verify the connection

    After enabling LDAP authentication and configuring users, you must provide the credentials of a user to connect to HiveServer2.

    1. Log on to the cluster over SSH. For more information, see Log on to a cluster.

    2. Run the following command to connect to HiveServer2.

      • Beeline client:

        beeline -u jdbc:hive2://master-1-1:10000 -n <user> -p <password>

      • JDBC:

        jdbc:hive2://master-1-1:10000/default;user=<user>;password=<password>
      Note

      <user> is the user that is configured in the hive.server2.authentication.ldap.groupFilter configuration item, and <password> is the password for that user. These are the username and password that you added in Step 1.

    Troubleshooting

    Hive connection error after enabling LDAP authentication

    • Problem: The following error message appears when you run a Beeline command to connect to HiveServer2.

      [root@master-1-1(xxx) ~]# beeline -u jdbc:hive2://master-1-1:10000 -n xxx -p xxx
SLF4J: Class path contains multiple SLF4J bindings.
SLF4J: Found binding in [jar:file:/opt/apps/HIVE/hive-3.1.3-hadoop3.1-1.0.9/lib/log4j-slf4j-impl-2.17.2.jar!/org/slf4j/impl/StaticLoggerBinder.class]
SLF4J: Found binding in [jar:file:/opt/apps/HADOOP-COMMON/hadoop-3.2.1-1.3.5-alinux3/share/hadoop/common/lib/slf4j-log4j12-1.7.25.jar!/org/slf4j/impl/StaticLoggerBinder.class]
SLF4J: See http://www.slf4j.org/codes.html#multiple_bindings for an explanation.
SLF4J: Actual binding is of type [org.apache.logging.slf4j.Log4jLoggerFactory]
Connecting to jdbc:hive2://master-1-1:10000
25/08/11 17:58:17 [main]: WARN jdbc.HiveConnection: Failed to connect to master-1-1:10000
Unknown HS2 problem when communicating with Thrift server.
Error: Could not open client transport with JDBC Uri: jdbc:hive2://master-1-1:10000: Peer indicated failure: Error validating the login (state=08S01,code=0)

    • Cause: The user specified in the Beeline command is not authorized by the LDAP group filter.

    • Solution: Specify the user in the hive.server2.authentication.ldap.groupFilter parameter. Alternatively, connect to HiveServer2 by using a user who is already specified in the hive.server2.authentication.ldap.groupFilter parameter.