Hi @Kent Brodie, it's important to distinguish authentication and authorization in security discussions. Ranger manages the authorization aspect of security, assuring that users have compliant access policies defined for the assets to which they require access.
Authentication--proving that user identity is genuine--is not managed by Ranger. In secured clusters, authentication is managed via Kerberos, via integration with Active Directory (or another Kerberos implementation such as MIT-KDC, etc.). Users authenticate to their KDC, obtaining a ticket-granting ticket or TGT, and present this TGT to the various Hadoop services in order to prove their identity, that they are who they say they are. Ranger uses this identity--proven to be genuine by the Kerberos protocol--in its mapping of policies to assets.
Yes, you are on the right track in thinking about Knox. Knox is a gateway to your secured Hadoop services, and can be a centralized point for enforcement of authentication. By integrating Knox and your AD infrastructure, you can enforce authorization at this gateway to the cluster services.
Please let us know what further questions you have.
