Support Questions
Find answers, ask questions, and share your expertise

Ranger LDAP groups not working

Solved Go to solution
Highlighted

Ranger LDAP groups not working

I have successfully setup Ranger LDAP sync. I can see all users and mapped groups in Ranger. I also have added my machines to our domain and I am able to see the group mappings from active directory by typing hdfs groups username. However, when I try to add an AD group to an HDFS folder through ranger the users in that group are still denied. Any suggestions?

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted

Re: Ranger LDAP groups not working

Expert Contributor
6 REPLIES 6
Highlighted

Re: Ranger LDAP groups not working

Expert Contributor
Highlighted

Re: Ranger LDAP groups not working

Well I am not sure if that really applies to my situation. For example, I can add a user to the ranger pollicy and the ranger permissions work, but if I add a group instead it does not work.

Highlighted

Re: Ranger LDAP groups not working

Expert Contributor

@David Williamson,

Can you check the ranger audit logs and see which policy is denying access? Also, you can enable debug logs on the hdfs and see what is the group name sent as part of the authorization request to ranger.

If you can post the output of the "hdfs groups" for the failed case and the corresponding group names for policy configuration, that will be helpful.

Thanks,

Sailaja.

Highlighted

Re: Ranger LDAP groups not working

After changing the case for the groups and reimporting everything then it synced from the hosts and now everything is working.

Highlighted

Re: Ranger LDAP groups not working

Explorer

Did you change only the groups to lowercase?

Highlighted

Re: Ranger LDAP groups not working

Explorer

It's working for me now with our AD. I had to add the group as external with @domainname.com, even if Ranger imports this without. You don't have to do anything else. The reason for this: in our environment if I executing groups [userid], I get the AD Groups in FQDN format, so you have to have it in Ranger in FQDN format too.