question Re: Kerberos users not showing up in Ranger policy creation UI in Support Questions

Kerberos users not showing up in Ranger policy creation UI

RobertCare — Mon, 16 Dec 2019 14:39:28 GMT

I have installed the HDP sandbox HDP-3.0.1.0 (3.0.1.0-187) using Docker and Kerberized the cluster.

This works, i can kinit myuser and make an API request to Atlas:

curl --negotiate -u : sandbox-hdp.hortonworks.com:21000/api/atlas/admin/version

Now I would like to create a Ranger policy that includes my Kerberos user, however the autocomplete for users does not show any of my Kerberos users... I did read this post (https://community.cloudera.com/t5/Support-Questions/Autocompletion-of-names-not-working-in-Ranger/td-p/109988), however this problem seems to be slightly different.

What do I need to do to make Kerberos users show up in the Ranger policy creation UI?

Shelton — Mon, 16 Dec 2019 22:33:29 GMT

To test-run loading User and Group data into Ranger before committing to the changes:

Set ranger.usersync.policymanager.mockrun=true. This parameter can be found in Ambari> Ranger> Configs> Advanced> Advanced ranger-ugsync-site.
View the Users and Groups that will be loaded into Ranger: tail -f /var/log/ranger/usersync/usersync.log.
After confirming that the users and groups are retrieved as intended, set ranger.usersync.policymanager.mockrun=false and restart Ranger Usersync.
This will sync the users shown in the usersync log to the Ranger database.

HTH

RobertCare — Wed, 18 Dec 2019 14:26:17 GMT

For some reason I thought that it wasn't necessary to have LDAP in addition to Kerberos.

I went on setting up an LDAP environment and was able to sync users to Ranger. Thanks!