Does Ranger authenticate HDFS users

[#1]

Ok. I am very confused with this Ranger product. There is no proper documentation on this aspect.

Dose Ranger authenticate a user before accessing HDFS content?

Is it just for authorization purpose only?

I got some consultant say, if you just use Ranger for Hdfs, you can fake as someone else and connect to the HDFS.

For example, you have a user called phil and john. They have /tenent/users/phil and /users/john respectively. Both directories has directory level permission to only that particular user and for group owner hdfs.

Is it possible for Phil to create a unix account as john on a linux box. Sudo as john on that machine and access hdfs as john. There by faking himself as john.

Appreciate any insights on this

[#2 · Accepted solution]

Ranger is just for authorization.

For central authentication, you can authenticate against an LDAP or AD. For local authentication, you can authenticate as a local unix user.

For true secure authentication, you need Kerberos with either a MIT KDC or AD as your KDC.

Yes it is possible without Kerberos to spoof a user.

See also this HCC post Kerberos, AD, Ranger

[#3]

Ranger provides authorization and audit functionalities. You should use KERBEROS authentication to secure the Hadoop clusters along with Ranger. If you use SIMPLE authentication, the users can impersonate as other users by setting appropriate ENV variable before invoking hdfs commands.