Ranger Plugins with Kerberos: Users for lookup?

benhadoop — Thu, 30 Jun 2016 17:34:21 GMT

Hi community,

working through the documentation, I stumbled about some pages regarding Ranger Plugins when enabling Kerberos (Link).

The documentation states the requirement to create some extra users for lookup purposes (such as rangerhdfslookup) for HDFS, HBase, Hive and Knox. The HDP documentation is the only place I found this information.

Is this a mandatory requirement? Why is this user needed?

Hope you can clear this up for me.

Best regards, Benjamin

Re: Ranger Plugins with Kerberos: Users for lookup?

benhadoop — Thu, 30 Jun 2016 17:46:16 GMT

Oh well, I think I found the answer in the community:

"If your cluster is kerberized you'll need one more account usually called "rangerlookup" to facilitate autocompletion of databases, tables etc, with a headless principal and a password (keytab unsupported). The docs talk about a rangerlookup account per service (hdfs, hbase, etc.) but I use only one." (Source: https://community.hortonworks.com/questions/21818/can-proxyuser-group-be-redefined-as-something-else.html)

Other helpful entries:

https://community.hortonworks.com/questions/12039/ranger-ui-for-hive-plug-in-auto-complete-of-tables.html

https://community.hortonworks.com/questions/21145/autocompletion-of-names-not-working-in-ranger.html

https://community.hortonworks.com/questions/432/permissions-necessary-for-the-user-required-to-con.html

question Re: Ranger Plugins with Kerberos: Users for lookup? in Archives of Support Questions (Read Only)

Ranger Plugins with Kerberos: Users for lookup?

Re: Ranger Plugins with Kerberos: Users for lookup?