Created 09-07-2018 12:04 AM
Verified various links but could not come up with solution.
Ranger policy is not applied to a user when policy has user group name but is successful when applied to user directly.
Here is the information:
a) HDP - 2.6.5; Ranger - 0.7.0; CentOS 6.5; Windows 2012 R2 is used as AD ( has full admin privileges on AD )
Incremental Sync - Enabled
Username Attribute - sAMAccountName; User Object Class: user; User Search Filter: cn=*; user search scop: sub; User Group Name Attribute - memberOf,ismemberof; Group User Map Sync - False or disabled.
Enable Group Sync - Enabled; Group Member Attribute - member; Group Name Attribute - sAMAccountName; Group Object Class - group;Group Search Filter - CN=*; Enable Group Search First - False or disabled.
c) On OS side:
hdfs groups <username> gives the group name of the user and the same user name ( with exact case ) is present in Ranger Groups
Still the user is not able to access hive databases in spite of policy allowing members of group to which the user belongs to.
Can someone please help me on this.
@spolavarapu @Felix Albani or anyone can help me on this.
Created 09-10-2018 02:01 PM
1. Can you please loging to the host hosting namenode.
2. id UserName : shows the group the user is pointed to .
Do you see the group present in Ranger for the user.
There is also a possibility that LDAP is configured directly, and the grousp are being pulled from LDAP.
Created 09-10-2018 02:26 PM
I was able to do this by adding the following parameters in Custom core-site.xml in HDFS through Ambari: Please change the figures as per the environment.
Please accept my answer if you found this helpful.
Created 09-10-2018 02:31 PM
Is OS integrated with AD or LDAP?
id <username> should reflect group on OS.
In my case, OS is not integrated with LDAP.
Created 09-10-2018 02:39 PM
In my hadoop cluster OS, Ranger and Kerberos is integrated with an external AD. id <username> and hdfs groups <username> both show group to which user belongs.
Created 09-10-2018 06:17 PM
Can you post the output of the hdfs groups and the screenshot of ranger groups? Also, it will be good to enable debug for "org.apache.ranger" for hdfs logs so that we can see what is the group name that is coming in for authorization request.
Created 09-10-2018 06:24 PM
@spolavarapu...In my case - OS is not integrated with AD and on OS level id <username> does not give any details.
Is this an issue? Integration of OS with AD is mandatory?
Created 09-10-2018 06:29 PM
so what does hdfs groups for that user return then? In section (C) of your initial post, you mentioned that the hdfs groups match the ones under Ranger groups.