question Re: Ranger UI - LDAP integration for internal and external users in Archives of Support Questions (Read Only)

Ranger UI - LDAP integration for internal and external users

sarah_maadawy — Fri, 15 Jul 2016 08:10:38 GMT

My understanding about the users list in Ranger UI portal is that:

the internal users are the ones who are allowed to access the Ranger UI portal
the external users are only allowed to use Hadoop services according to their privilages but are not allowed to access the Ranger UI portal.

What I want to do is:

Use LDAP to sync external users
User different LDAP settings to sync internal users

It seems to me that the settings for both are read from the same place. Is that correct?

Re: Ranger UI - LDAP integration for internal and external users

VR46 — Fri, 15 Jul 2016 08:24:03 GMT

Hello @Sarah Maadawy,

The internal users are the Linux system users which Ranger usersync syncs from the local Linux OS. They are not always allowed access to the Ranger UI portal.

The external users (can be from AD / LDAP) are synced by Ranger usersync to be used for policy creation.

Having cleared that, here are you answers:

Use LDAP to sync external users
- http://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.3.4/bk_Ranger_Install_Guide/content/ranger_user_sync_ldap_ad.html

User different LDAP settings to sync internal users
- There is nothing like LDAP to sync internal users, what you might be looking for is - using LDAP users to access the Ranger UI portal.
- http://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.3.4/bk_Ranger_Install_Guide/content/configure_ranger_authentication.html#configuring_ranger_ldap_authentication

So yes, there are two different LDAP sections which you can use to achieve both.

Hope this helps. Thanks.

Re: Ranger UI - LDAP integration for internal and external users

sarah_maadawy — Fri, 15 Jul 2016 08:53:37 GMT

So, @Vipin Rathor does that mean that a user who is allowed to access Ranger UI is (always) an internal user while not every internal user is allowed to access the web UI?

Re: Ranger UI - LDAP integration for internal and external users

VR46 — Fri, 15 Jul 2016 10:20:31 GMT

@Sarah Maadawy No. That means that the external users can be allowed to access Ranger UI and not every internal user is allowed the access by default.

Re: Ranger UI - LDAP integration for internal and external users

sarah_maadawy — Fri, 15 Jul 2016 11:08:57 GMT

So, if my target is to "set LDAP connection to allow users to use their LDAP credentials to login to Ranger UI":

If I used the link that you provided (http://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.3.4/bk_Ranger_Install_Guide/content/configure_ranger_authentication.html#configuring_ranger_ldap_authentication). The users will still not be allowed to access the Ranger portal and there will still be an extra step to give them enough privileges to do that (i.e. add them to a group or something?)

And if both internal and external users can eventually have privileges to login to the portal, why would I use one link instead of the other?

Sorry, I am a newbie and trying to understand all this 😞