Edit service authorization in Knox

[#1]

I would like to alter who has access to different Knox Services. For example, I can currently access all the services using guest:guest-password or admin:admin-password but would like to change that so only admin can access certain services. I believe it will mean changing something in the default.xml file in the Knox topologies. I have tried adding this parameter to the default.xml, but I can still access HBase as a guest.

<param> 
	<name>webhbase.acl</name> 
	<value>admin</value>            
</param>

It's not just HBase I would like to change but custom services too so a more general answer would be very much appreciated.

[#2]

@Sam Bass

I believe you need Ranger + Knox http://docs.hortonworks.com/HDPDocuments/HDP2/HDP-...

Knox policies http://docs.hortonworks.com/HDPDocuments/HDP2/HDP-...

[#3 · Accepted solution]

You may find Sample 5 in my recent blog here helpful.

http://kminder.github.io/knox/2015/11/18/knox-with...

The only quick tip I can give you here without more information is that your authorization provider configuration should probably look like this.

    <provider>
      <role>authorization</role>
      <name>AclsAuthz</name>
      <enabled>true</enabled>
      <param name="WEBHBASE.acl" value="admin;*;*"/>
    </provider>

For your custom services all you need to do is match the value before the ".acl" with the role of your custom service. This example may help clarify.

    <provider>
      <role>authorization</role>
      <name>AclsAuthz</name>
      <enabled>true</enabled>
      <param name="WEBHBASE.acl" value="admin;*;*"/>
      <param name="CUSTOM.acl" value="guest;*;*"/>
    </provider> 

Of course you can also use the Ranger authorization plugin and instead of this "AclsAuthz" plugin and define the policy in the Ranger policy UI.

[#4]

Additional examples are available in the Apache Knox Users Guide under Authorization

[#5]

@Kevin Minder

Thanks, that worked just as I needed it to.