Create HDFS/Hive User via Ranger

[#1]

Hello,

I need to know if there is a way to create a hdfs/hadoop or hive user via Ranger, not via shell. I can provide or deny access to hdfs folders or files, hive tables or columns, but to the users that already exists.

Does anyone knows how I can do it?

[#2]

Ranger does not have any facility to create hadoop users in the nodes. If there are hadoop users which you want to authorize you can use Ranger Usersync to bring those into Ranger or in Ranger Admin UI you can create that user ( Settings-->Users/Groups-->Add new user) like kvarakantham had mentioned in the previous post. This enables you to create policy against those users.

[#3]

Hello guys,

First of all thanks for your help.

My Ranger is already configured with Usersync, I can see that users that were created and give them permissions. My biggest question is if the user that i create on Ranger are only internal to Ranger or they can access hdfs, hive, etc...

[#4 · Accepted solution]

The users created in the Ranger Admin UI are internal to Ranger. They are to be used for accessing Ranger Admin UI and nothing more.

Users with access to the cluster must be created elsewhere and then sync'd into Ranger to control their authorization.

[#5]

Hi,

How can I give permissions to local(Unix) user to access HDFS/hive when sync with ldap in ranger.

[#6]

Hello @Erik Nor,

Thanks, do you know where is the easiest way to create cluster users (rather than via shell), for hive, hdfs etc?

[#7]

There are a variety of ways, mostly dependant upon your environment. If you are using purely local accounts and want a GUI to create the users you can use Hue.

[#8]

Hello @Erik Nor,

we created a new Hue user, but it does not appeared in Ranger. How could we syncronize it?

[#9]

That is correct, I guess I wasn't clear. Adding the user in Hue will take care of generating the user home in HDFS, but you will still need to drop to the shell to create the local user in linux. This will become cumbersome for larger clusters and is only realistic for small test clusters.

Ideally you will want to use ldap to manage your users. Whether that means using an enterprise LDAP/AD or using a tool like freeIPA and its web UI combined with Kerberos. Together these will provide you with very secure authentication while also providing a GUI to create users which can be sync'd to Ranger.

[#10]

Simply You can create users in AD and those will sync in Ranger.