Currently, Hue users are manually synced from LDAP. Their Hue user accounts are stored in an SQLite database.
Ideally, there would be an 'analytics' LDAP group to which we could add users. We could then use full LDAP authentication in Hue, and skip syncing accounts altogether.
Alternatively, we should use the MySQL meta instance as the user account state store instead of SQLite.
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | Ottomata | T127850 Improve Hue user management | |||
| Resolved | elukey | T242026 Access to analytics infrastructure for SNowick_WMF |
Some reference for CDH 5.5 are in http://www.cloudera.com/documentation/enterprise/5-5-x/topics/cdh_sg_hue_ldap_config.html
Ah, lemme restate my previous comment:
We should still get Hue LDAP group based login and permissions to work.
Right now accounts are synced fro LDAP, but they are done so one by one manually when someone needs a new account. It would be much better to just tell Hue that all uses in LDAP group X are allowed to login, and users in group Y are admins. Or at least the group X thing. :)
Another thing to consider is if the users need to be in a nda-like LDAP group or not.