Ranger policies not applied to HDFS and Hive

[#1]

Hello,
We have noticed that Ranger policies are no longer being enforced in HDFS and Hive in our CDP 7.3.1 cluster. Users are able to access data despite explicit deny or allow rules configured in the Ranger UI.

Details:

• Ranger UI is up and running; all policies are visible and enabled.

• HDFS and Hive services do not reflect the expected access restrictions.

• Restarting Ranger, Hive, and HDFS services did not resolve the issue.

• We are not sure when the issue started.

Could you please assist us in identifying why the Ranger policies are no longer being enforced in HDFS and Hive? Let us know what additional logs or configurations would help with troubleshooting.

[#2]

@Artem_Kuzin 

I suggest starting with logging in to Ranger UI and verifying under "Audit" --> "Plugin Status" that your HDFS and Hive services are reported as having downloaded and made active the latest updated policies.

If they  have not, I start checking the HDFS and Hive logs for any logging related to issues connecting or fetching policies json from Ranger.

Beyond above, I'd recommend that you open a support case with Cloudera (assuming you have a valid support license) where you can securely share your configuration and logs for more in-depth troubleshooting assistance with this issue.

Please help our community grow. If you found any of the suggestions/solutions provided helped you with solving your issue or answering your question, please take a moment to login and click "Accept as Solution" on one or more of them that helped.

Thank you,
Matt

[#3]

Hi Matt,

Thank you for your suggestions.

We've confirmed that all plugins, including HDFS and Hive, have successfully downloaded and activated the latest policies as reflected in the Ranger UI → Audit → Plugin Status.

However, after enabling Ranger Authorization on the HDFS side, we are seeing recurring warnings in the logs every minute:

WARN RangerAuditMetricRESTClient RangerAdminRESTClient.handleJwt(): Since JWTokenRetriver init failed, skipping JWT auth.
WARN RangerRESTClient RangerRESTClient.handleJwt(): Since JWTokenRetriver is null, skipping JWT auth.

We are not using JWT in our environment — Kerberos is in place for authentication. Maybe this is related to the issue, and Ranger policies are being ignored.

[#4 · Accepted solution]

Hello @Artem_Kuzin 

I looked into this issue and it appears to be a bug in CDP version 7.3.1, which has been resolved in version 7.3.2.0