What is the Ranger edit service page on HIVE / HDFS meant for?

[#1]

Hi,

I can't figure out what these pages are meant for exactly within the Ranger component:

And the HDFS one:

I am asking since the Ranger HDFS / HIVE plugins both seem to work fine, policies can be published but nonetheless the 'TEST Connection' on both service configs can fail without upsetting your Ranger setup.

So, what is this about?

[#2]

In order to add policies for services, you first need to define the service. The pages that you reference are the service definitions for Hive and HDFS.

[#3]

@Jasper

Wherever you enable ranger plugin for 1st time and restart the service -[Eg. say HDFS], it will create HDFS repository with cluster name in Ranger Web UI. This repository contains the config params which indicates which cluster-HDFS service its connecting to [incase if there are multiple HDFS repositories in place].

In future if your namenode is moved to different machine the policies will not work and you need to modify the configs on the HDFS repository page accordingly to get it working.

Many reasons I see.. -few are

1. This page shows option to disable repository if you dont want it any more.

2. If you have kerberized cluster then default policies will not work. You need to modify repository settings properly to get the policies working.

etc..

[#4 · Accepted solution]

@Jasper

Ranger service - configuration has details on which hadoop components is using Ranger for authorization and what policies are there which can be enabled / disabled / audited or not. These service definitions gets created when you enable ranger for the respective components from Ambari and restart the service

These properties which are there against the services are used only for Test Connection and Lookup functionality which allows you to select the resource when you maintain policies, i.e auto population of the resource based on the resource name you are going to type in the field.

e.g For Hive when you maintain policies if the "Database" field if there are multiple databases in hive and some of them starts with letter "d" and you type "d" in that field in brings up a list of databases which starts with "d". Same case with HDFS it will bring the matching directories for the "PATH". Same with other components too.

To do this operation, Ranger communicates with respective hadoop component and brings those details. The user and config maintained here will be used for this communication and in kerberos it will be a service principal which will be used. These users will have policy to do these operations.

This is the main purpose of these configuration and it DOESN'T stop you from using the RANGER plugin if the TEST CONNECTION / LOOKUP is not working. It is just for added convenience when maintaining policies. There are lot of misconception around it.

In Kerberos environment in HDP 2.5 where ranger itself is kerberized , there are some "Add New Configuration" parameters get configured which maintains various users which communicates with Ranger admin to download policies, tags, service creation from ambari, service check etc.