question Re: Where do I control hbase namespace from ranger? in Archives of Support Questions (Read Only)

Where do I control hbase namespace from ranger?

sunile_manjee — Sun, 18 Aug 2019 12:30:52 GMT

This option is available in ranger but I don't see it. I have ranger version .50. Screen shot:

As you can see from above nothing for namespace. Am I missing something?

Re: Where do I control hbase namespace from ranger?

aervits — Wed, 24 Feb 2016 05:06:57 GMT

Please see this https://issues.apache.org/jira/plugins/servlet/mobile#issue/RANGER-202

In the table section, specify the namespace with table together

Re: Where do I control hbase namespace from ranger?

nsabharwal — Wed, 24 Feb 2016 07:42:14 GMT

@Sunile Manjee

See this https://issues.apache.org/jira/browse/RANGER-202 and it has more information on the issues related to this particular issue

Take a look on the subtasks.

It looks like that Ramesh replied back https://community.hortonworks.com/questions/17764/ranger-hbase-namespace.html

Format:

To allow access to table(s) in a specific namespace, specify the table name with prefix as "<namespace>:<table>" - like "myNameSpace:table1", "myNamespace:*"

Re: Where do I control hbase namespace from ranger?

nsabharwal — Sun, 18 Aug 2019 12:30:44 GMT

@Sunile Manjee

Demo

my_ns1:my_table - demouser can access it

hbase(main):005:0> scan "my_ns1:my_table"

ROW COLUMN+CELL

0 row(s) in 0.0340 seconds

hbase(main):006:0>

I removed demouser in policy

hbase(main):006:0> scan "my_ns1:my_table"

ROW COLUMN+CELL

ERROR: org.apache.hadoop.hbase.security.AccessDeniedException: Insufficient permissions for user ‘demouser',action: scannerOpen, tableName:my_ns1:my_table, family:fam.

Here is some help for this command:

Re: Where do I control hbase namespace from ranger?

sunile_manjee — Thu, 25 Feb 2016 04:47:47 GMT

@Neeraj Sabharwal awesome feedback as always. I need to know if ranger can do access control at namespace level without specifying table name.

Re: Where do I control hbase namespace from ranger?

sunile_manjee — Thu, 25 Feb 2016 04:48:13 GMT

@Artem Ervits awesome feedback as always. I need to know if ranger can do access control at namespace level without specifying table name.

Re: Where do I control hbase namespace from ranger?

sunile_manjee — Thu, 25 Feb 2016 04:48:50 GMT

I'm going to take a try on my sandbox... will post what I find.

Re: Where do I control hbase namespace from ranger?

aervits — Thu, 25 Feb 2016 04:49:50 GMT

@Sunile Manjee I doubt it, by design you need to specify namespace:table

Re: Where do I control hbase namespace from ranger?

sunile_manjee — Thu, 25 Feb 2016 05:40:08 GMT

@Neeraj Sabharwal @Artem Ervits

namespace:* works! but with a twist.

I created a namespace called 'testns'.

On ranger I am able to do testns:* and it gives me security access over all tables within this namespace. It worked with all namespace i created.

HOWEVER!!! - this does not work with default. So I need to create a new thread on HCC asking community why default namespace (default:*) is not controlable via ranger.

Re: Where do I control hbase namespace from ranger?

nsabharwal — Thu, 25 Feb 2016 07:26:39 GMT

@Sunile Manjee Did you see the link that I shared and extra information added in my reply?

I mentioned "See this https://issues.apache.org/jira/browse/RANGER-202 and it has more information on the issues related to this particular issue

Take a look on the subtasks."

One of the subtasks is https://issues.apache.org/jira/browse/RANGER-228

Re: Where do I control hbase namespace from ranger?

mehrdad_niasari — Thu, 21 Jul 2016 03:43:12 GMT

Is this problem solved? It's so weird that Apache Ranger doesn't support default:*. I'm wondering if there is any update for this issue or not?

Re: Where do I control hbase namespace from ranger?

sunile_manjee — Thu, 21 Jul 2016 04:34:52 GMT

@Artem Ervits @Mehrdad Niasari I believe we can lose this question. i have opened new one on default namespace here.