From 5933068e7074bf67f7cfc38e5a1a89b1767c190c Mon Sep 17 00:00:00 2001 From: Anu Engineer Date: Wed, 11 Oct 2017 15:58:20 -0700 Subject: [PATCH] HADOOP-13102. Update GroupsMapping documentation to reflect the new changes. Contributed by Esther Kundin. (cherry picked from commit 075358eb6fff5ae4a40ac4dfde292e2a9a4ceddf) --- .../hadoop-common/src/site/markdown/GroupsMapping.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/hadoop-common-project/hadoop-common/src/site/markdown/GroupsMapping.md b/hadoop-common-project/hadoop-common/src/site/markdown/GroupsMapping.md index 89aca16c3a2..806ed54225b 100644 --- a/hadoop-common-project/hadoop-common/src/site/markdown/GroupsMapping.md +++ b/hadoop-common-project/hadoop-common/src/site/markdown/GroupsMapping.md @@ -85,9 +85,10 @@ This file should be readable only by the Unix user running the daemons. It is possible to set a maximum time limit when searching and awaiting a result. Set `hadoop.security.group.mapping.ldap.directory.search.timeout` to 0 if infinite wait period is desired. Default is 10,000 milliseconds (10 seconds). +This is the limit for each ldap query. If `hadoop.security.group.mapping.ldap.search.group.hierarchy.levels` is set to a positive value, then the total latency will be bounded by max(Recur Depth in LDAP, `hadoop.security.group.mapping.ldap.search.group.hierarchy.levels` ) * `hadoop.security.group.mapping.ldap.directory.search.timeout`. -The implementation does not attempt to resolve group hierarchies. Therefore, a user must be an explicit member of a group object -in order to be considered a member. +`hadoop.security.group.mapping.ldap.base` configures how far to walk up the groups hierarchy when resolving groups. +By default, with a limit of 0, in order to be considered a member of a group, the user must be an explicit member in LDAP. Otherwise, it will traverse the group hierarchy `hadoop.security.group.mapping.ldap.search.group.hierarchy.levels` levels up. ### Active Directory ###