实践是检验真理的唯一标准！
-ldap_password_cmd：运行以检索LDAP密码的Shell命令
准备工作：
[root@localhost impala]$ vi /home/test/impala/pwd-impala
123456
[root@localhost impala]$ cat /home/test/impala/pwd-impala
123456先切换我当前的用户，以免混淆
[root@localhost impala]$ kinit hbase
Password for hbase: 123456
[root@localhost impala]$ klist
Default principal: hbase
....
# 然后再来执行impala的登录脚本,不指定端口，默认为21000
[root@localhost impala]$ impala-shell -i localhost -u hive -l --auth_creds_ok_in_clear --ldap_password_cmd="cat /home/test/impala/pwd-impala"
登录成功，打印如下信息：
Starting Impala Shell using LDAP-based authentication
Error connecting: TTransportException, TSocket read 0 bytes
Kerberos ticket found in the credentials cache, retrying the connection with a secure transport.
Connected to localhost:21000
Server version: impalad version ........)
***********************************************************************************
Welcome to the Impala shell.
(Impala Shell v2.11.0-cdh5.14.0 (d682065) built on Sat Jan 6 13:27:16 PST 2018)
To see a summary of a query's progress that updates in real-time, run 'set LIVE_PROGRESS=1;'.
***********************************************************************************
LDAP authentication is enabled, but the connection to Impala is not secured by TLS.
ALL PASSWORDS WILL BE SENT IN THE CLEAR TO IMPALA.
[localhost:21000] >show tables;
Query: show tables
ERROR: AuthorizationException: User 'hbase' does not have privileges to access: default.* '
# 打印如上信息，没有权限这表明用户登录没有成功，只能登录时没有报错，顺利进入impala命令行交互界面，但用户还是先前认证的hbase用户， hive用户没有生效
解决办法：先切换外部用户，在执行impala-shell登录脚本
# 切换用户
[root@localhost impala]$ kinit hive
Password for hive: 123456
[root@localhost impala]$ klist
Default principal: hive
......
[root@localhost impala]$ impala-shell -i localhost -u hive -l --auth_creds_ok_in_clear --ldap_password_cmd="cat /home/test/impala/pwd-impala"
登录成功，打印信息这里忽略不显示
......
[localhost:21000] >show tables;
Query: show tables
+-------------------------------------------------+
| name |
+-------------------------------------------------+
| customers |
| app |
| logs |
......
tched 163 row(s) in 0.14s
[localhost:21000] >
# 能显示则表示用户登录成功注意事项：
通过实践，发现使用--ldap_password_cmd指定用户密码时，用户密码正不正确都能登录，但是登录的用户将不再是你命令里指定的用户，而是当前系统登录的用户。
-ldap_password_cmd在实际开发中用得并不多，简单做个整理，如果有问题欢迎指正。