Should we disable HDFS default ACL to enable Ranger HDFS plugin?

[#1]

In Sandbox HDP 2.3.2 / Ambar 2.1.2, Ranger is enabled in HDFS out of the box. When I tried to get ACL on CLI, I got the error as follows:

[hdfs@sandbox ~]$ hdfs dfs -getfacl /user/hdfs # file: /user/hdfs # owner: hdfs # group: hdfs getfacl: The ACL operation has been rejected. Support for ACLs has been disabled by setting dfs.namenode.acls.enabled to false.

Is it recommended to disable default ACL? If it is enabled, will we see ACL set command generating Ranger policies?

[#2]

In a real cluster dfs.namenode.acls.enabled is set to true.

The sandbox is configured for a wide audience to run into the least amount of problems doing the tutorials.

And no, the acl command does not generate Ranger policies.

You set the policies in Ranger and it will manage the ACLs for HDFS as the

dfs.namenode.inode.attributes.provider.class is set to

org.apache.ranger.authorization.hadoop.RangerHdfsAuthorizer

See Slides 18 and 19 in

http://www.slideshare.net/Hadoop_Summit/securing-hadoop-with-apache-ranger

If there are no Ranger policies, it falls back to HDFS ACL

[#3]

but if we set the dfs.namenode.acls.enabled = true and xasecure.add-hadoop-authorization" = true then only hadoop acl will take precedence and ranger policies will be over ridden. @ Ancil McBarnett

[#4]

Also setting "xasecure.add-hadoop-authorization" = false in ranger-hdfs-security.xml in /etc/hadoop/conf will stop the fall back to HDFS ACL.

[#5]

I think there are some global policies created whenever we enable any Ranger plugin in Sandbox. This global policy by default blocks access to all. So for other policies to work or for it to fallback on the other authorization method, we need to disable this global policy.

Example : Like in this case, need to review if under HDFS Repo in Ranger, any global policy exists? If yes, need to disable it. In this case it will not fallback to HDFS ACLs if this global policy exists.