Ldap Authentication User filter in Hive: failing - hadoop

Question

I want to implement the restrictions in the LDAP authentication, only want a specific group to have access on hive. Below are the properties I have given in the **hive-site.xml**. But the filter is not working.
Kindly check the following code and help me out with this ?
**Hive Version: Hive 2.1.1
Release label: emr-5.4.0
Hadoop distribution:Amazon 2.7.3**
Below mentioned properties I have tried adding in the hive-site.xml but they didn't worked and login was unsuccessful. Without these I was able to login using ldap mechanism as only ldap server url and authnetication:LDAP was mentioned:
<property>
<name>hive.server2.authentication.ldap.baseDN</name>
<value>ou=Root,dc=int,dc=domain,dc=com</value>
</property>
<property>
<name>hive.server2.authentication.ldap.groupBaseDN</name>
<value>CN=Groups,OU=Root,DC=int,DC=domain,DC=com</value>
</property>
<property>
<name>hive.server2.authentication.ldap.groupFilter</name>
<value>hadoop-admins</value>
</property>
<property>
<name>hive.server2.authentication.ldap.customLDAPQuery</name>
<value><![CDATA[(&(objectClass=person)(memberOf=CN=hadoop-admins,OU=Groups,OU=Root,Dc=int,DC=domain,DC=com)))]]>
</value>
</property>
Kindly let me know if you have faced the same issue.
Error:
2017-12-20T10:29:32,414 WARN [HiveServer2-Handler-Pool: Thread-45([])]: conf.HiveConf (HiveConf.java:initialize(3768)) - HiveConf of name hive.server2.authentication.ldap.groupBaseDN does not exist
2017-12-20T10:29:32,493 ERROR [HiveServer2-Handler-Pool: Thread-45([])]: transport.TSaslTransport (TSaslTransport.java:open(315)) - SASL negotiation failure
javax.security.sasl.SaslException: Error validating the login

Answer 1

It looks like there is an inconsistency between the filter
(memberOf=CN=hadoop-admins,OU=Groups,OU=Root,Dc=int,DC=domain,DC=com)
and the groupeBaseDN
hive.server2.authentication.ldap.groupBaseDN
CN=Groups,OU=Root,DC=int,DC=domain,DC=com
I'm confident that if you correct the groupBaseDN, things should work.