question Re: Ranger AD/LDAP into unix groups in Archives of Support Questions (Read Only)

Ranger AD/LDAP into unix groups

sunile_manjee — Wed, 20 Apr 2016 09:30:02 GMT

Does ranger creates unix groups during AD/LDAP sync? Curious if the unix groups are used (based on sync) for authorization or native AD/LDAP groups.

Re: Ranger AD/LDAP into unix groups

pvillard — Wed, 20 Apr 2016 15:35:41 GMT

Hi Sunile,

I believe unix groups are not created during AD/LDAP sync with Ranger, however I think that if a policy cannot be checked with AD/LDAP, it will then be checked against unix groups before failing.

Re: Ranger AD/LDAP into unix groups

mthiele1 — Wed, 20 Apr 2016 20:41:33 GMT

Does ranger creates unix groups during AD/LDAP sync?

No - the usersync just brings in the users and groups for you to see and to be able to create Ranger policy based on the known users and groups . It does not create them it just reads from your defined source be it unix , AD/LDAP .

Curious if the unix groups are used (based on sync) for authorization or native AD/LDAP groups.

You create policy and this will let you control access not authorization.

The underlying linux filesystem still needs to have SSSD or winBind/samba setup to show the same groups on the filesystem and the group names need to be the same . Ranger User sync will not create these groups in linux or hdfs.