question amb_ranger_admin/ranger_admin_username user on kerberized cluster in Archives of Support Questions (Read Only)

amb_ranger_admin/ranger_admin_username user on kerberized cluster

capacman — Mon, 24 Apr 2017 22:44:23 GMT

Hi All,

I dont understand what (ranger_admin_username)"amb_ranger_admin" user is for? I enabled kerberos on my cluster and installed ranger. Everything is working very well. I changed "ranger_admin_username" value to some meaningless value but it is still working. So is ranger_admin_username still a relevant property in a kerberos enabled cluster? In the mean time there is no "amb_ranger_admin" in ambari internal users as well. It was not created by ambari or ranger.

Re: amb_ranger_admin/ranger_admin_username user on kerberized cluster

vperiasamy — Mon, 24 Apr 2017 22:53:20 GMT

Main purpose of amb_ranger_admin is for ambari to communicate to ranger to create ranger repositories (when ranger plugins get enabled).

In kerberos enabled clusters, starting from HDP 2.5/Ambari 2.4, service keytabs are used for the above purpose. Hence amb_ranger_admin is applicable only for non kerberos environments. What version of HDP are you using?

Re: amb_ranger_admin/ranger_admin_username user on kerberized cluster

capacman — Mon, 24 Apr 2017 23:12:41 GMT

Hi @vperiasamy,

Thank you for quick response.

We are using 2.5.3. In the mean time, is this information still correct for ambari enabled plugins:

https://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.5.3/bk_security/content/hdfs_plugin_kerberos.html

What I understand, ambari making this config automatically? Am I correct?

Re: amb_ranger_admin/ranger_admin_username user on kerberized cluster

vperiasamy — Thu, 04 May 2017 05:16:21 GMT

Starting from HDP 2.5.3, you don't need to setup separate lookup users mentioned in that link (for kerberized environments).

Re: amb_ranger_admin/ranger_admin_username user on kerberized cluster

capacman — Thu, 04 May 2017 05:33:37 GMT

Thank you vperiasamy