amb_ranger_admin/ranger_admin_username user on kerberized cluster

[#1]

Hi All,

I dont understand what (ranger_admin_username)"amb_ranger_admin" user is for? I enabled kerberos on my cluster and installed ranger. Everything is working very well. I changed "ranger_admin_username" value to some meaningless value but it is still working. So is ranger_admin_username still a relevant property in a kerberos enabled cluster? In the mean time there is no "amb_ranger_admin" in ambari internal users as well. It was not created by ambari or ranger.

[#2 · Accepted solution]

Main purpose of amb_ranger_admin is for ambari to communicate to ranger to create ranger repositories (when ranger plugins get enabled).

In kerberos enabled clusters, starting from HDP 2.5/Ambari 2.4, service keytabs are used for the above purpose. Hence amb_ranger_admin is applicable only for non kerberos environments. What version of HDP are you using?

[#3]

Hi @vperiasamy,

Thank you for quick response.

We are using 2.5.3. In the mean time, is this information still correct for ambari enabled plugins:

https://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.5.3/bk_security/content/hdfs_plugin_kerberos.ht...

What I understand, ambari making this config automatically? Am I correct?

[#4]

Starting from HDP 2.5.3, you don't need to setup separate lookup users mentioned in that link (for kerberized environments).

[#5]

Thank you vperiasamy