The Knox Gateway uses group membership for Service Level Authorization only. The gateway does not propagate the user's group when communicating with the Hadoop cluster.
The group.principal.mapping
parameter of the identity-assertion
provider determines the user's group membership. The gateway evaluates this parameter
after the principal.mapping
parameter using the effective user. Unlike principal.mapping
, the group mapping
applies all the matching values. A user is a member of all matching groups.
Note | |
---|---|
Although user and group mappings are often used together, the instructions in this section only explain how to add group mappings. |