Support Questions
Find answers, ask questions, and share your expertise

Ranger LDAP groups not working

Solved Go to solution

Ranger LDAP groups not working

I have successfully setup Ranger LDAP sync. I can see all users and mapped groups in Ranger. I also have added my machines to our domain and I am able to see the group mappings from active directory by typing hdfs groups username. However, when I try to add an AD group to an HDFS folder through ranger the users in that group are still denied. Any suggestions?

1 ACCEPTED SOLUTION

Accepted Solutions

Re: Ranger LDAP groups not working

Expert Contributor
6 REPLIES 6

Re: Ranger LDAP groups not working

Expert Contributor

Re: Ranger LDAP groups not working

Well I am not sure if that really applies to my situation. For example, I can add a user to the ranger pollicy and the ranger permissions work, but if I add a group instead it does not work.

Re: Ranger LDAP groups not working

Expert Contributor

@David Williamson,

Can you check the ranger audit logs and see which policy is denying access? Also, you can enable debug logs on the hdfs and see what is the group name sent as part of the authorization request to ranger.

If you can post the output of the "hdfs groups" for the failed case and the corresponding group names for policy configuration, that will be helpful.

Thanks,

Sailaja.

Re: Ranger LDAP groups not working

After changing the case for the groups and reimporting everything then it synced from the hosts and now everything is working.

Re: Ranger LDAP groups not working

Explorer

Did you change only the groups to lowercase?

Re: Ranger LDAP groups not working

Explorer

It's working for me now with our AD. I had to add the group as external with @domainname.com, even if Ranger imports this without. You don't have to do anything else. The reason for this: in our environment if I executing groups [userid], I get the AD Groups in FQDN format, so you have to have it in Ranger in FQDN format too.