Group Synchronization Backends in Hue

Published on 01 October 2013 in Development - 3 minutes read - Last modified on 19 April 2021

Hueis the turn-key solution for Apache Hadoop. It hides the complexity of the ecosystem including HDFS, Oozie, MapReduce, etc. Hue provides authentication and integrates with SAML, LDAP, and other systems. A new feature added in Hue is the ability to synchronize groups with a third party authority provider. In this blog post, we’ll be covering the basics of creating a Group Synchronization Backend.

 

The Design

The purpose of the group synchronization backends are to keep Hue’s internal group lists fresh. The design was separated into two functional parts:

  1. A way to synchronize on every request.
  2. A definition of how and what to synchronize.

![image][1]

Image 1: Request cycle in Hue with a synchronization backend.

The first function is a Django [middleware][2] that is called on every request. It is intended to be immutable, but configurable. The second function is a backend that can be customized. This gives developers the ability to choose how their groups and user-group memberships can be synchronized. The middleware can be configured to use a particular synchronization backend and will call it on every request. If no backend is configured, then the middleware is disabled.

 

Creating Your Own Backend

A synchronization backend can be created by extending a class and providing your own logic. Here is an example backend that comes [packaged][3] with Hue:

class LdapSynchronizationBackend(DesktopSynchronizationBackendBase):
  USER_CACHE_NAME = 'ldap_use_group_sync_cache'

  def sync(self, request):
    user = request.user

    if not user or not user.is_authenticated:
      return

    if not User.objects.filter(username=user.username, userprofile__creation_method=str(UserProfile.CreationMethod.EXTERNAL)).exists():
      LOG.warn("User %s is not an Ldap user" % user.username)
      return

    # Cache should be cleared when user logs out.
    if self.USER_CACHE_NAME not in request.session:
      request.session[self.USER_CACHE_NAME] = import_ldap_users(user.username, sync_groups=True, import_by_dn=False)
      request.session.modified = True
In the above code snippet, the synchronization backend is defined by extending “DesktopSynchronizationBackendBase”. Then, the method “sync(self, request)” is overridden and provides the syncing logic. ## Configuration The synchronization middleware can be configured to use a backend by changing “desktop -> auth -> [user_group_membership_synchronization_backend][4]” to the full import path of your class. For example, setting this config to “desktop.auth.backend.LdapSynchronizationBackend” configures Hue to synchronize with the configured LDAP authority. ## Design Intelligently Backends in Hue are extremely powerful and can affect the performance of the server. So, they should be designed in such a fashion that they do not do any operations that block for long periods of time. Also, they should manage the following appropriately: 1. Throttling requests to whatever service contains the group information. 2. Ensuring users are authenticated. 3. Caching if appropriate. #   # Summary Hue is enterprise grade software ready to integrate with LDAP, SAML, etc. The newest feature, Group Synchronization, ensures corporate authority is fresh in Hue. It’s easy to configure and create backends and Hue comes with an LDAP backend. Hue is undergoing heavy development and are welcoming external contributions! Have any suggestions? Feel free to tell us what you think through [hue-user][5] or [@gethue][6]. [1]: http://media.tumblr.com/67f0b72e07cf0a824f6360e7ceaad73a/tumblr_inline_mu04cse78O1qzo3ii.png [2]: https://docs.djangoproject.com/en/1.4/topics/http/middleware/ [3]: https://github.com/cloudera/hue/blob/23933dd0a1ce182d03549221143ea930c78640b7/desktop/core/src/desktop/auth/backend.py#L377 [4]: https://github.com/cloudera/hue/blob/master/desktop/conf.dist/hue.ini#L98 [5]: https://groups.google.com/a/cloudera.org/forum/?fromgroups#!forum/hue-user [6]: http://twitter.com/gethue/

comments powered by Disqus

More recent stories

03 May 2023
Discover the power of Apache Ozone using the Hue File Browser
Read More
23 January 2023
Hue 4.11 and its new dialects and features are out!
Read More