Ranger policy malfunction in kafka

[#1]

In kafka, I tried to execute consume/publish command with disabled all policies of Ranger, it did not deny both consume/publish behavior. Did I miss any configuration setting of kafka or misunderstanding something else?

[#2]

@bdurai @bganesan

I was able to reproduce this. I have only kafka user listed in Kafka policy and root can consume and produce the data "not listed in kafka policy.

@Benson Shih

[#3]

@Benson Shih check this https://github.com/abajwa-hw/security-workshops/blob/master/Setup-ranger-23.md#setup-kafka-plugin-fo...

[#4]

Is this issue resolved? I also tried to create a kafka ranger policy to exclude a select user from not creating or deleting topics. But it doesn't get enforced. I see the 200 response in Ranger Audits that Kafka plugin is up.

[#5]

@Anna Shaverdian see this https://community.hortonworks.com/articles/12699/ranger-and-kafka-integration-faq.html

[#6]

Is the Ranger plugin properly installed? For example, do you any evidence of it in Ranger Audit logs, e.g. kafaka server connecting to Ranger to download policies or access log indicating that access was allowed by ranger?

[#7]

I will check for it

[#8]

Please check your server.properties file and ensure you have authorizer.class.name set to Ranger Authorizer's Fully Qualified class name.

[#9]

It`s supposes to be "org.apache.ranger.authorization.kafka.authorizer.RangerKafkaAuthorizer" right?

[#10]

Also look into the Ranger Audits from the Ranger Admin. If Ranger is allowing the request, then it will have policy which gave the permission.