Configure HDP Search Solr ranger plugin

[#1]

This article with cover step by step how to configure HDP Search Solr with Ranger Plugin

Step 1

Download and install the 2.2.9+ mpack - FYI: Previous mpack versions don't support integration of HDP Search Solr with Ranger. Mpack 2.2.9 includes configurable section for the solr-security on ambari which allows to add the authorization information.

wget 'http://public-repo-1.hortonworks.com/HDP-SOLR/hdp-solr-ambari-mp/solr-service-mpack-2.2.9.tar.gz'; -O /tmp/solr-service-mpack-2.2.9.tar.gz

ambari-server install-mpack --mpack=/tmp/solr-service-mpack-2.2.9.tar.gz

Step 2

On HDP solr host run

yum install ranger-solr-plugin.noarch

cd /usr/hdp/2.6.2.0-205/ranger-solr-plugin

Edit install.properties and make sure the following settings at least are properly configured:

POLICY_MGR_URL=http://<ranger-host>:6080 
SQL_CONNECTOR_JAR=/usr/share/java/mysql-connector-java.jar

Edit solr-plugin-install.properties and set correct value for install dir:

COMPONENT_INSTALL_DIR_NAME=/opt/lucidworks-hdpsearch/solr/server 

Next source the environment and enable the plugin:

source /etc/hadoop/hadoop-env.sh 
./enable-solr-plugin.sh

Step 3

Update security znode with ranger authorization class

kinit -kt solr.service.keytab solr/<host>@REALM.COM 

/opt/lucidworks-hdpsearch/solr/server/scripts/cloud-scripts/zkcli.sh -z '<zookeeper>:2181' -cmd put /solr/security.json '{"authentication":{"class": "org.apache.solr.security.KerberosPlugin"},"authorization":{"class": "org.apache.ranger.authorization.solr.authorizer.RangerSolrAuthorizer"}}'

Also on Ambari->Solr-Config->Advance solr-security set:

{
"authentication":{"class": "org.apache.solr.security.KerberosPlugin"},
"authorization":{"class": "org.apache.ranger.authorization.solr.authorizer.RangerSolrAuthorizer"}
} 

Save and restart, on the operation start output you should see

- call['/opt/lucidworks-hdpsearch/solr/server/scripts/cloud-scripts/zkcli.sh -zkhost <zookeeper1>:2181,<zookeeper2>:2181,<zookeeper3>:2181 -cmd get /solr/security.json'] {'timeout': 60, 'env': {'JAVA_HOME': u'/usr/jdk64/jdk1.8.0_112'}}
- call returned (0, '{\"authentication\":{\"class\": \"org.apache.solr.security.KerberosPlugin\"},\"authorization\":{\"class\": \"org.apache.ranger.authorization.solr.authorizer.RangerSolrAuthorizer\"}}')
- Solr Security Json was found, it will not be overridden

Step 4

Fix clustername for solr plugin

cd /opt/lucidworks-hdpsearch/solr/server/solr-webapp/webapp/WEB-INF/classes/ 

Edit ranger-solr-audit.xml and add following property

  <property>
     <name>ranger.plugin.solr.ambari.cluster.name</name>
      <value>YOUR_CLUSTER_NAME</value>
    </property>

Restart solr for changes to reflect.

Step 5

Open Ranger Admin UI and edit solr repository add New Configurations

tag.download.auth.users = solr
policy.download.auth.users = solr
ambari.service.check.user = ambari-qa