Ranger policy malfunction in kafka

[#1]

In kafka, I tried to execute consume/publish command with disabled all policies of Ranger, it did not deny both consume/publish behavior. Did I miss any configuration setting of kafka or misunderstanding something else?

[#2]

I will check for it, too

[#3]

@Benson Shih

did you turn off the global allow policy for Kafka?

[#4]

What is it mean? Could you give me an example thanks.

[#5]

@Artem Ervits yes I turned off the global policy for Kafka, but it did not work.

[#6]

Is it correct that the kafka and ranger must be in the kerberized cluster environment?

[#7]

@Benson Shih See this

https://cwiki.apache.org/confluence/display/RANGER/Kafka+Plugin#KafkaPlugin-CanIauthorizeraccesstoKa...

[#8]

@Benson Shih Just created an article based on this https://community.hortonworks.com/articles/12699/ranger-and-kafka-integration-faq.html

Very useful to resolve this issue.

[#9]

Hi @Neeraj Sabharwal,

I still can not deny Publish and Consume actions,my policy setting as below:

my environment is not a kerberized cluster and also I did not observe any records in Access of Audit,any suggestion?

thanks.

[#10]

BTW, the following steps are how I enabled ranger for kafka and executed Publish/Consume actions:

1. In kafka Configs > Advanced ranger-kafka-aduit > enable "Audit to DB" and changed value of "xasecure.audit.destination.hdfs.dir" to "hdfs://140.92.XX.XX:8020/ranger/audit"

2. Configs > Advanced ranger-kafka-plugin-properties > enable "Enable Ranger for KAFKA"

3. save changes and restart KAFKA

4. go to Ranger admin UI and I saw the repository of kafka has been created automatically

[#11]

Executing consume/publish steps:

Step1: connect to kafka-broker server

step2: changer user $ su kafka

step3: go to bin folder $ cd /usr/hdp/2.3.0.0-2557/kafka/bin

step4: create a topic $ ./kafka-topics.sh --create --zookeeper {hostname}:2181 --replication-factor 1 --partitions 1 --topic test

step5: execute publish message $ ./kafka-console-producer.sh --broker-list {hostname}:6667--topic test

This is a test message //it should be denied right?

step6: execute consume message $ ./kafka-console-consumer.sh --zookeeper {hostname}:2181 --topic test --from-beginning

//it also should be denied?