Support Questions
Find answers, ask questions, and share your expertise
Announcements
Alert: Welcome to the Unified Cloudera Community. Former HCC members be sure to read and learn how to activate your account here.

Ranger policy for group not working...Checked all previous but no clue

Highlighted

Ranger policy for group not working...Checked all previous but no clue

Contributor

Hi,

Verified various links but could not come up with solution.

Ranger policy is not applied to a user when policy has user group name but is successful when applied to user directly.

Here is the information:

a) HDP - 2.6.5; Ranger - 0.7.0; CentOS 6.5; Windows 2012 R2 is used as AD ( has full admin privileges on AD )

b) Settings:

Incremental Sync - Enabled

Username Attribute - sAMAccountName; User Object Class: user; User Search Filter: cn=*; user search scop: sub; User Group Name Attribute - memberOf,ismemberof; Group User Map Sync - False or disabled.

Enable Group Sync - Enabled; Group Member Attribute - member; Group Name Attribute - sAMAccountName; Group Object Class - group;Group Search Filter - CN=*; Enable Group Search First - False or disabled.

c) On OS side:

hdfs groups <username> gives the group name of the user and the same user name ( with exact case ) is present in Ranger Groups

Still the user is not able to access hive databases in spite of policy allowing members of group to which the user belongs to.

Can someone please help me on this.

@spolavarapu @Felix Albani or anyone can help me on this.

7 REPLIES 7

Re: Ranger policy for group not working...Checked all previous but no clue

1. Can you please loging to the host hosting namenode.
2. id UserName : shows the group the user is pointed to .

Do you see the group present in Ranger for the user.

There is also a possibility that LDAP is configured directly, and the grousp are being pulled from LDAP.

Highlighted

Re: Ranger policy for group not working...Checked all previous but no clue

Hi Sriram

I was able to do this by adding the following parameters in Custom core-site.xml in HDFS through Ambari: Please change the figures as per the environment.

hadoop.security.group.mapping=org.apache.hadoop.security.CompositeGroupsMapping

hadoop.security.group.mapping.provider.ad4users=org.apache.hadoop.security.LdapGroupsMapping

hadoop.security.group.mapping.provider.ad4users.ldap.base=dc=csmodule,dc=com

hadoop.security.group.mapping.provider.ad4users.ldap.bind.user=cn=username,OU=Users,DC=hortonworks,DC=com

hadoop.security.group.mapping.provider.ad4users.ldap.bind.password=password

hadoop.security.group.mapping.provider.ad4users.ldap.search.attr.group.name=cn

hadoop.security.group.mapping.provider.ad4users.ldap.search.attr.member=member

hadoop.security.group.mapping.provider.ad4users.ldap.search.filter.group=(objectclass=group)

hadoop.security.group.mapping.provider.ad4users.ldap.search.filter.user=(&(|(objectclass=person)(objectclass=applicationProcess))(sAMAccountName={0}))

hadoop.security.group.mapping.provider.ad4users.ldap.url=ldap-url:389

hadoop.security.group.mapping.provider.shell4services=org.apache.hadoop.security.ShellBasedUnixGroupsMapping

hadoop.security.group.mapping.providers=ad4users,shell4services

hadoop.security.group.mapping.providers.combined=true

Reference:

https://github.com/apache/hadoop/blob/f67237cbe7bc48a1b9088e990800b37529f1db2a/hadoop-common-project...

Please accept my answer if you found this helpful.

Highlighted

Re: Ranger policy for group not working...Checked all previous but no clue

Contributor

@Saurabh,

Is OS integrated with AD or LDAP?

id <username> should reflect group on OS.

In my case, OS is not integrated with LDAP.

Highlighted

Re: Ranger policy for group not working...Checked all previous but no clue

In my hadoop cluster OS, Ranger and Kerberos is integrated with an external AD. id <username> and hdfs groups <username> both show group to which user belongs.

Highlighted

Re: Ranger policy for group not working...Checked all previous but no clue

Expert Contributor

@Sriram,

Can you post the output of the hdfs groups and the screenshot of ranger groups? Also, it will be good to enable debug for "org.apache.ranger" for hdfs logs so that we can see what is the group name that is coming in for authorization request.

Highlighted

Re: Ranger policy for group not working...Checked all previous but no clue

Contributor

@spolavarapu...In my case - OS is not integrated with AD and on OS level id <username> does not give any details.

Is this an issue? Integration of OS with AD is mandatory?

Highlighted

Re: Ranger policy for group not working...Checked all previous but no clue

Expert Contributor

so what does hdfs groups for that user return then? In section (C) of your initial post, you mentioned that the hdfs groups match the ones under Ranger groups.

Don't have an account?
Coming from Hortonworks? Activate your account here