question Re: Edit service authorization in Knox in Archives of Support Questions (Read Only)

Edit service authorization in Knox

sambass — Fri, 18 Dec 2015 23:22:14 GMT

I would like to alter who has access to different Knox Services. For example, I can currently access all the services using guest:guest-password or admin:admin-password but would like to change that so only admin can access certain services. I believe it will mean changing something in the default.xml file in the Knox topologies. I have tried adding this parameter to the default.xml, but I can still access HBase as a guest.

<param> 
	<name>webhbase.acl</name> 
	<value>admin</value>            
</param>

It's not just HBase I would like to change but custom services too so a more general answer would be very much appreciated.

Re: Edit service authorization in Knox

nsabharwal — Fri, 18 Dec 2015 23:38:41 GMT

@Sam Bass

I believe you need Ranger + Knox http://docs.hortonworks.com/HDPDocuments/HDP2/HDP-...

Knox policies http://docs.hortonworks.com/HDPDocuments/HDP2/HDP-...

Re: Edit service authorization in Knox

kevin_minder — Fri, 18 Dec 2015 23:40:04 GMT

You may find Sample 5 in my recent blog here helpful.

http://kminder.github.io/knox/2015/11/18/knox-with...

The only quick tip I can give you here without more information is that your authorization provider configuration should probably look like this.

    <provider>
      <role>authorization</role>
      <name>AclsAuthz</name>
      <enabled>true</enabled>
      <param name="WEBHBASE.acl" value="admin;*;*"/>
    </provider>

For your custom services all you need to do is match the value before the ".acl" with the role of your custom service. This example may help clarify.

    <provider>
      <role>authorization</role>
      <name>AclsAuthz</name>
      <enabled>true</enabled>
      <param name="WEBHBASE.acl" value="admin;*;*"/>
      <param name="CUSTOM.acl" value="guest;*;*"/>
    </provider>

Of course you can also use the Ranger authorization plugin and instead of this "AclsAuthz" plugin and define the policy in the Ranger policy UI.

Re: Edit service authorization in Knox

amiller — Sat, 19 Dec 2015 03:25:53 GMT

Additional examples are available in the Apache Knox Users Guide under Authorization

Re: Edit service authorization in Knox

sambass — Mon, 21 Dec 2015 19:33:30 GMT

@Kevin Minder

Thanks, that worked just as I needed it to.