Ranger UI - LDAP integration for internal and external users

[#1]

My understanding about the users list in Ranger UI portal is that:

• the internal users are the ones who are allowed to access the Ranger UI portal
• the external users are only allowed to use Hadoop services according to their privilages but are not allowed to access the Ranger UI portal.

What I want to do is:

• Use LDAP to sync external users
• User different LDAP settings to sync internal users

It seems to me that the settings for both are read from the same place. Is that correct?

[#2 · Accepted solution]

Hello @Sarah Maadawy,

The internal users are the Linux system users which Ranger usersync syncs from the local Linux OS. They are not always allowed access to the Ranger UI portal.

The external users (can be from AD / LDAP) are synced by Ranger usersync to be used for policy creation.

Having cleared that, here are you answers:

• Use LDAP to sync external users
  • http://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.3.4/bk_Ranger_Install_Guide/content/ranger_user_...

• User different LDAP settings to sync internal users
  • There is nothing like LDAP to sync internal users, what you might be looking for is - using LDAP users to access the Ranger UI portal.
  • http://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.3.4/bk_Ranger_Install_Guide/content/configure_ra...

So yes, there are two different LDAP sections which you can use to achieve both.

Hope this helps. Thanks.

[#3]

So, @Vipin Rathor does that mean that a user who is allowed to access Ranger UI is (always) an internal user while not every internal user is allowed to access the web UI?

[#4]

@Sarah Maadawy No. That means that the external users can be allowed to access Ranger UI and not every internal user is allowed the access by default.

[#5]

So, if my target is to "set LDAP connection to allow users to use their LDAP credentials to login to Ranger UI":

If I used the link that you provided (http://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.3.4/bk_Ranger_Install_Guide/content/configure_ra...). The users will still not be allowed to access the Ranger portal and there will still be an extra step to give them enough privileges to do that (i.e. add them to a group or something?)

And if both internal and external users can eventually have privileges to login to the portal, why would I use one link instead of the other?

Sorry, I am a newbie and trying to understand all this 😞