question Ranger Lookup User in Kerberos -> Does the local user require a Primary or Secondary group membership of any kind? in Archives of Support Questions (Read Only)

Ranger Lookup User in Kerberos -> Does the local user require a Primary or Secondary group membership of any kind?

rbailey — Fri, 03 Feb 2017 07:54:42 GMT

Hello guys, I'm thinking this might be quick: ranger[hdfs|hbase|knox|hive]lookup user required for Knox integration (

https://community.hortonworks.com/questions/21818/can-proxyuser-group-be-redefined-as-something-else.html

) does anybody know if it needs any groups associated with it (or even should it?)

Re: Ranger Lookup User in Kerberos -> Does the local user require a Primary or Secondary group membership of any kind?

tstebbens — Fri, 03 Feb 2017 17:39:15 GMT

@rbailey No, technically they don't need a group associated with them. Also they don't need to be able to login to any systems. As long as there is a principal in Kerberos for them and they can authenticate against the KDC you should be okay. As per the answer in the other article you linked to I usually just create a single 'rangerlookup' user and principal to be used by all the services.

Re: Ranger Lookup User in Kerberos -> Does the local user require a Primary or Secondary group membership of any kind?

rbailey — Fri, 03 Feb 2017 19:49:20 GMT

Excellent, I have successfully created the user with uid=gid and it worked fine. Thanks!