Ranger policy malfunction in kafka

[#1]

In kafka, I tried to execute consume/publish command with disabled all policies of Ranger, it did not deny both consume/publish behavior. Did I miss any configuration setting of kafka or misunderstanding something else?

[#2]

@Benson Shih I really appreciate you sharing the details.

In the Ranger policy, Did you set the IP?

Can I authorize access to Kafka over a non-secure channel via Ranger?

Yes. you can control access by ip-address.

[#3]

@Benson Shih See this

This Kafka feature is available in HDP releases 2.3.4 (Dal-M20) or later.

[#4]

very thanks for @Neeraj Sabharwal `s response in advance,

1. I have a little confused about how to setting the ip address ranger, am I suppose to specify namenode host ip?

2. What about earlier version of HDP like 2.3.0?

[#5]

@Benson Shih You would allow the traffic from those IP.

HDP 2.3.4 ...No HDP2.3.0 or HDP 2.3.2

[#6]

I used HDP2.3.4 with ip address ranger:

after set up the policy,then I went to 140.92.27.89 command line to change user to kafka, executing Publish and Consume actions,but it still did not deny..,

[#7]

@Benson Shih, what does the Audit say? It should have the policyId which gave permission.

[#8]

Hi @bdurai,

I did not observe any information about kafka in Audit(Access); However, after I add a property "authorizer.class.name=org.apache.ranger.authorization.kafka.authorizer.RangerKafkaAuthorizer" in Custom kafka-broker and executed Publish action,Audit Access could appeared information as below(why it did not show "publish" Access Type):

In addition, it get some error when I executed Publish action:

[#9]

@Benson Shih It's failing on authorization.

[#10]

Hi @Neeraj Sabharwal, it`s right that failing on authorization, but it is suppose to be authorized by Ranger right? it`s so weird that Ranger cannot control the Publish or Consume actions.

[#11]

@Benson Shih Yes..it suppose to be ..Could you do me a favor ? Please disable the kafka policy and try to see if you can run the job.