Does it need to ues Kerberos when install Ranger-storm plugin?

[#1]

Hi ALL:

We have successfully installed Storm Plugin for apache ranger, and we are also able to create policies within ranger, the problem is that when we click the Connection Test button after add a storm service,we got a error about Kerberos.The error report is that:

org.apache.ranger.plugin.client.HadoopException: executeUnderKerberos: Login failure using given configuration parameters, username : `admin`..

executeUnderKerberos: Login failure using given configuration parameters, username : `admin`.. kerberos.example.com: Name or service not known.

Hadoop Version:2.7.2

Ranger Version: 0.62

Storm Version:1.0.0

Any ideas or help in this regard will be appreciated.

Thanks in advance.

Regards,

Benny

[#2]

we can see the plugin on Ranger admin in Audit >plugins tab

[#3 · Accepted solution]

To enable ranger-storm-plugin need to have kerberos environment. Refer: Enabling Storm Plugin

Also link /etc/hadoop/conf/core-site.xml under /etc/storm/conf

[#4]

@mvaradkar Thank you very much for you reply.we will follow you advice,and holp it will helps to solve the problem.thank you again.

[#5]

@hu bai Pls follow steps as per given on - https://github.com/abajwa-hw/security-workshops/blob/master/Setup-ranger-23.md#setup-storm-plugin-fo...

[#6]

@Sagar Shimpi Thank you very much for you reply.Because I am a student ,I should study apache ranger wihtout Ambari. It also help for my work and thank you again for you reply.

[#7]

@hu bai

Contrary to popular belief, it is not necessary to enable Kerberos to use the Ranger plugin. Kerberos is for authentication, while Ranger does authorization. You can use other authentication techniques to identify the user, if you choose. Kerberos is a very secure and reliable way of authenticating a user, and that is why is is frequently used. However, you can use Unix auth or LDAP authentication in your cluster to identify the user. The username which submits the Storm topology is the one used for authorization with Ranger. Ranger will then use its policy information to determine what the user is allowed to do.

[#8]

@emaxwell just heard from engineering, in case of Storm, kerberos is required for Ranger authorization.