Support Questions

Find answers, ask questions, and share your expertise

Ranger LDAP groups not working

avatar
Contributor

I have successfully setup Ranger LDAP sync. I can see all users and mapped groups in Ranger. I also have added my machines to our domain and I am able to see the group mappings from active directory by typing hdfs groups username. However, when I try to add an AD group to an HDFS folder through ranger the users in that group are still denied. Any suggestions?

1 ACCEPTED SOLUTION

avatar
Expert Contributor
6 REPLIES 6

avatar
Expert Contributor

avatar
Contributor

Well I am not sure if that really applies to my situation. For example, I can add a user to the ranger pollicy and the ranger permissions work, but if I add a group instead it does not work.

avatar
Expert Contributor

@David Williamson,

Can you check the ranger audit logs and see which policy is denying access? Also, you can enable debug logs on the hdfs and see what is the group name sent as part of the authorization request to ranger.

If you can post the output of the "hdfs groups" for the failed case and the corresponding group names for policy configuration, that will be helpful.

Thanks,

Sailaja.

avatar
Contributor

After changing the case for the groups and reimporting everything then it synced from the hosts and now everything is working.

avatar
Contributor

Did you change only the groups to lowercase?

avatar
Contributor

It's working for me now with our AD. I had to add the group as external with @domainname.com, even if Ranger imports this without. You don't have to do anything else. The reason for this: in our environment if I executing groups [userid], I get the AD Groups in FQDN format, so you have to have it in Ranger in FQDN format too.