To authenticate Hue with LDAP, you must have:

• LDAP server
• Bind account (or support for anonymous binds)
• Cloudera Manager account with Full Administrator permissions
• [optional] LDAP server with LDAPS or StartTLS encryption.

Search bind authentication does an ldapsearch against one or more directory services and binds with the found distinguished name (DN) and password. Hue searches the subtree from the base distinguished name. If LDAP Username Attribute is set, Hue looks for an entry whose attribute has the same value as the short name given at login.

1. Log on to Cloudera Manager and click Hue.
2. Click the Configuration tab and filter by scope=Service-wide and category=Security.
3. Set the following required properties:

   Authentication Backend	desktop.auth.backend.LdapBackend
   LDAP URL	ldaps://<ldap_server>:636 (or ldap://<ldap_server>:389)
   LDAP Server CA Certificate	/path_to_certificate/cert.pem
   LDAP Search Base	DC=mycompany,DC=com
   LDAP Bind User Distinguished Name	username@domain
   LDAP Bind Password	bind_user_password

   Use Search Bind Authentication	TRUE
   Enable LDAP TLS	FALSE if using LDAPS or not encrypting
   Create LDAP users on login	TRUE

     Note: To encrypt with TLS, set LDAP URL to ldap://<ldap_server>:389 and check Enable LDAP TLS. For a proof of concept without encryption, use ldap://<ldap_server>:389, remove the value for LDAP Server CA Certificate, and uncheck Enable LDAP TLS.
4. You can optionally improve search performance with attributes and filters.

   LDAP User Filter	objectclass=user (default = *)
   LDAP Username Attribute	sAMAccountName (AD default), uid (LDAP default)
   LDAP Group Filter	objectclass=group (default = *)
   LDAP Group Name Attribute	cn (default)
   LDAP Group Membership Attribute	member (default)

     Note: With the user settings in the table above, the LDAP search filter has the form: (&(objectClass=user)(sAMAccountName=<user entered username>)).
5. Add any valid user and/or valid group to quickly test your LDAP configuration.

   LDAP Username for Test LDAP Configuration	Any valid user
   LDAP Group Name for Test LDAP Configuration	Any valid group

6. Click Save Changes.
7. Test your LDAP configuration, and when successful, Restart Hue.

## You can test ldapsearch at the command line as follows: 
LDAPTLS_CACERT=/<path_to_cert>/<ca_certificate> ldapsearch -H ldaps://<ldap_server>:636 \
-D "<bind_dn>" -w <bind_password> -b <base_dn> "samaccountname=<user>"

To authenticate with direct binding, Hue needs either the User Principal Name (UPN) for Active Directory, or the full path to the LDAP user in the Directory Information Tree (DIT) for open standard LDAP.

To directly bind to an Active Directory/LDAP server with NT domain:

1. Log on to Cloudera Manager and click Hue.
2. Click the Configuration tab and filter by scope=Service-wide and category=Security.
3. Set LDAP properties exactly like Search Bind with these exceptions:

   Active Directory Domain	<your NT domain>
   LDAP Bind User Distinguished Name	<username only> (not username@domain)
   Use Search Bind Authentication	FALSE

4. Click Save Changes.
5. Test your LDAP configuration, and when successful, Restart Hue.

To directly bind to an open standard LDAP server with a username pattern:

1. Remove the value for Active Directory Domain.
2. Set both LDAP Username Pattern and LDAP Bind User Distinguished Name to a DN string that represents the full path of the directory information tree, from UID to top level domain.

You can test your LDAP settings without restarting the Hue service-simply input values and save changes.

1. Configure Hue LDAP Search Bind or Direct Bind.
2. Add a user and group name for Test LDAP Configuration.
3. Click Save Changes.
4. Select Actions > Test LDAP Configuration.
5. Click Test LDAP Configuration.
6. Restart Hue when the test succeeds and log on to the Hue Web UI.

Example of a Search Bind configuration encrypted with LDAPS:

[[custom]]
[[auth]]
backend=desktop.auth.backend.LdapBackend

[[ldap]]
ldap_url=ldaps://w2k8-1.ad.sec.cloudera.com:636
search_bind_authentication=true
ldap_cert=/<path_to_cacert>/w2k8-1-root.pem
use_start_tls=false
create_users_on_login=true
base_dn="DC=ad,DC=sec,DC=cloudera,DC=com"
bind_dn="<username>@ad.sec.cloudera.com"
bind_password_script=<path_to_password_script>/<script.sh>
test_ldap_user="testuser1"
test_ldap_group="testgroup1"

[[[users]]]
user_filter="objectclass=user"
user_name_attr="sAMAccountName"

[[[groups]]]
group_filter="objectclass=group"
group_name_attr="cn"
group_member_attr="member"

Example of a Direct Bind configuration for Active Directory encrypted with LDAPS:

[[ldap]]
ldap_url=ldaps://w2k8-1.ad.sec.cloudera.com:636
search_bind_authentication=false
nt_domain=ad.sec.cloudera.com
ldap_cert=/<path_to_cacert>/w2k8-1-root.pem
use_start_tls=false
create_users_on_login=true
base_dn="DC=ad,DC=sec,DC=cloudera,DC=com"
bind_dn="<username>"
bind_password_script=<path_to_password_script>/<script.sh>
...

Example of a Direct Bind configuration for Active Directory encrypted with StartTLS:

[[ldap]]
ldap_url=ldap://w2k8-1.ad.sec.cloudera.com:389
search_bind_authentication=false
nt_domain=ad.sec.cloudera.com
ldap_cert=/opt/cloudera/security/cacerts/w2k8-1-root.pem
use_start_tls=true
create_users_on_login=true
base_dn="DC=ad,DC=sec,DC=cloudera,DC=com"
bind_dn="cconner"
bind_password_script=<path_to_password_script>/<script.sh>
...