Can ranger work with AD without Kerberos?

[#1]

Hi,

I am trying to use AD for ranger usersync and authentication but without Kerberos. Does that work?

Also, does ranger groupsync with AD work without setting the Hadoop AD Group mapping as mentioned in ?

http://docs.hortonworks.com/HDPDocuments/Ambari-2.2.0.0/bk_Ambari_Security_Guide/content/setting_up_...

[#2]

If you want to use AD for authentication, you have to use Kerberos. That is the facility for authentication that AD provides. Group sync will work without setting the group mapping, but that means that the O/S groups and AD groups will not be in sync.

[#3]

Is that really true? You can use the LDAP interface for all frontends and you I think can even do Linux->AD integration using LDAP as well. https://technet.microsoft.com/en-us/magazine/2008.12.linux.aspx#id0060006 I totally agree with you that this doesn't make sense but it should theoretically work I would think.

[#4]

@Benjamin Leonhardi LDAP is not authentication, it is for user management, group management, etc. Kerberos is what provides the authentication piece (I am who I say I am). If you integrate with LDAP for users, you can still impersonate a user because you don't have to actually go through an authentication process.

[#5]

@emaxwellLDAP would provide the authentication for linux, ambari, Hive, hue etc. What it wouldn't cover would provide authentication for the native apis that is correct. But if you work in an environment where you basically trust the users and don't have too sensitive data i.e. you just want to make sure they don't accidentally do something bad ( like in a scientific environment ) its definitely still a possibility.

[#6]

As a general statement this is not right by any means. LDAP provides secure and encrypted authentication (encrypted user password and SSL/TLS communication) , together with user/group management. It's only the Hadoop stack does not support this and the two only autentication methods implemented for all the CDP components are the dummy simple auth (described above) and the Kerberos authentication (used in combination with PAM or LDAP for user/group mappings).

As an example, nothing less than Knox (the security gateway to HDP or CDP) implements full authenticacion using only LDAP (with TLS), and it only relies on Kerberos to authenticate a single service/proxy user to communicate with the rest of the cluster.

[#7]

It works. But is it secure? No. Unauthorized impersonation is the biggest problem in the cluster. With Kerberos you won't have this problem. When you run the sync command from the linux box, you need to have a user principal that can get kerberos tickets for authN. AD Group Mapping must be in sync with OS/HDFS to ensure consistent authZ across components.

[#8 · Accepted solution]

@Madhavi Amirneni . You are trying to use AD as a simple LDAP. This works . Ranger without Kerberos is not of much use. The best practice for securing Hadoop cluster is to Kerberize the cluster first and then enable ranger.

As an example, How you can bypass the Authorization without Authentication.

usseradd baduser

su - baduser

whoami - confirm you are baduser, who has no special access or group memberships.

hdfs dfs -ls /user/

You should get a directory listing

hdfs dfs /user/ambari-qa

hdfs dfs -ls /user/ambari-qa

You should get denied as ambari-qa doesnt have world read permission.

HADOOP_USER_NAME=hdfs ===> Now Impersonating as hdfs user.

hdfs dfs -ls /user/ambari-qa

you should get into the directory . Now you just hacked HDFS!!!

You could potentiall do.

hdfs dfs rm -r / and delete all the data!!!!!!!

This why authorization without authentication is not of much help.! . This why you need KERBEROS.

Hope this helps.