Support Questions
Find answers, ask questions, and share your expertise

Does Ranger authenticate HDFS users

Solved Go to solution

Does Ranger authenticate HDFS users

New Contributor

Ok. I am very confused with this Ranger product. There is no proper documentation on this aspect.

Dose Ranger authenticate a user before accessing HDFS content?

Is it just for authorization purpose only?

I got some consultant say, if you just use Ranger for Hdfs, you can fake as someone else and connect to the HDFS.

For example, you have a user called phil and john. They have /tenent/users/phil and /users/john respectively. Both directories has directory level permission to only that particular user and for group owner hdfs.

Is it possible for Phil to create a unix account as john on a linux box. Sudo as john on that machine and access hdfs as john. There by faking himself as john.

Appreciate any insights on this

1 ACCEPTED SOLUTION

Accepted Solutions

Re: Does Ranger authenticate HDFS users

Ranger is just for authorization.

For central authentication, you can authenticate against an LDAP or AD. For local authentication, you can authenticate as a local unix user.

For true secure authentication, you need Kerberos with either a MIT KDC or AD as your KDC.

Yes it is possible without Kerberos to spoof a user.

See also this HCC post Kerberos, AD, Ranger

1191-screen-shot-2016-01-04-at-70916-pm.png

View solution in original post

2 REPLIES 2

Re: Does Ranger authenticate HDFS users

Ranger is just for authorization.

For central authentication, you can authenticate against an LDAP or AD. For local authentication, you can authenticate as a local unix user.

For true secure authentication, you need Kerberos with either a MIT KDC or AD as your KDC.

Yes it is possible without Kerberos to spoof a user.

See also this HCC post Kerberos, AD, Ranger

1191-screen-shot-2016-01-04-at-70916-pm.png

View solution in original post

Re: Does Ranger authenticate HDFS users

Explorer

Ranger provides authorization and audit functionalities. You should use KERBEROS authentication to secure the Hadoop clusters along with Ranger. If you use SIMPLE authentication, the users can impersonate as other users by setting appropriate ENV variable before invoking hdfs commands.