Authenticating Hue Users with LDAP Credentials

This section explains how to edit the ldap section of the hue.ini file to enable Hue user authentication with LDAP credentials. These instructions assume you have completed the steps in Setting up Users from an LDAP Database.

WARNING

If you switch to authentication through LDAP credentials, the Hue User Admin users will lose superuser privileges unless you take one of the following actions:

  • Import one or more superuser accounts from LDAP and assign them superuser permission.

  • If you have already enabled the LDAP authentication back end, log into Hue using the LDAP back end, which will create an LDAP user. Next, disable the LDAP authentication back end and use User Admin to give the superuser permission to the new LDAP user.

Before you edit the parameters in the hue.ini file, determine whether your LDAP server allows anonymous searches.

  • If anonymous searches are allowed, use the direct bind method.
  • If anonymous searches are not allowed, use bind credentials (also known as search and bind).

The following flow chart shows which parameters you must specify for each of these authentication methods:

These are the parameters you need to set in the ldap section of the hue.ini file so you can authenticate Hue users with LDAP credentials:

Parameter Description Comments
search_bind_authentication Determines which authentication method to use: search and bind, or direct bind.

When set to true, Hue performs an LDAP search using bind_dn and bind_password as provided in hue.ini. The search can be further limited by the search filter user_filter.

When set to false, Hue performs a direct bind to LDAP using the credentials provided from one of these sources:

  • the UPN, formed by concatenating <shortname> (the user name provided on the Hue login page) and nt_domain (if nt_domain is specified)
  • the ldap_username_pattern (if nt_domain is not specified)
nt_domain

The NT domain to connect to.

This parameter is only used with Active Directory.

Used with the direct bind method of authentication.

If nt_domain is specified, then ldap_username_pattern is ignored.
ldap_username_pattern Used to connect to directory services other than Active Directory.

Used with the direct bind method of authentication.

Usually takes the form "cn=<username>,dc=example,dc=com"

backend The backend to use for authenticating users. Needs to be set to desktop.auth.backend.LdapBackend for Hue authentication.