User not allowed to do 'DECRYPT_EEK' despite the group to which the user belong have proper access

[#1]

Hi All,

I have created an encryption zone and I am not able to copy data into this encryption zone using USER_1 which belongs to GROUP_1 and getting the below error:

copyFromLocal: User:USER_1 not allowed to do 'DECRYPT_EEK' on 'key1'

In ranger ranger kms policies I have given full access to the group GROUP_1. But still I am facing this issue. Is it like group level policies does not apply for Ranger KMS or is there some configuration I have to tweak to make it work.

Please help me understand this issue and also any clue or suggestion is appreciated.

FYI, the cluster is kerberized.

thanks in advance.

[#2]

HDp is 2.5.3 and ranger is 0.6.0

[#3]

@sachin gupta

Do you have a setup doc you used for the user , group, and creation of the encrypted zone? or did you follow a standard Horton works example if so which one?

I really want to reproduce as much as possible your environment and test dome solutions

[#4]

I have created encryption zone using hdfs crypto command only I think thats the hortonworks standard.

[#5]

@sachin gupta

Have a look at this document I tried to recreate your environment

HDP 2.6 
Ranger /KMS 0.7.0 
Kerberized
Created opera1 {user_1} 
Created group Operator {group_1}

And the tests were successful !!! Please go through the document and revert. The file can't load because of it big due to screenshots. Here is the link

Please revert if you have any questions

[#6]

I told you in previous comments that I have ranger kms 0.6 and not 0.7, So can you please create your env with ranger kms 0.6 and test ? And again thanks for being helpful so far.

[#7]

@Geoffrey Shelton Okot;@sachin gupta

Have you found solution for the problem? I have exactly the same issue that kms works for user, but not for group. I did what was suggested in kms-acls.xml but it didn't work either. My ambari 2.5.1, hdp 2.6.1. Thanks.

[#8]

@Gregory YaoI could not find any solution for this. If you find any solution for this please post here I still have this issue in my environment.