newly created user can't log in to ambari

[#1]

I created a new internal user in Ranger. When I attempt to log in to ambari with that user, I get the following error message:

"Unable to sign in. Invalid username/password combination."

I went to ranger and changed the password to make sure it was correct. Then tried again but I still got the same error.

Ranger is syncing to unix.

[#2 · Accepted solution]

@cduby that's expected behavior. Internal Ranger users can log into the Ranger UI, depending on their permissions, (and have Ranger policies assigned to them), but not necessarily the Ambari UI. Ambari has its own local users that are stored in Ambari's database.

Ranger syncing external users from Unix doesn't affect this.

[#3]

@slachterman

How do I add users in ambari in the sandbox? I log in as raj_ops but I don't see any way to add users. Maybe I need to log in as a different user?

Also, how do Ranger and Ambari negotiate the internal users. For example, if I log into hive view as a local ambari user, how does it map that user to a ranger user? Do you have to sync with AD or unix to make that work?

[#4]

@cduby you'll need to log in to Ambari as a user that has access to Manage Users and Groups, like the admin user.

It just matches on the username string (noting that mapping rules may modify that value), based on the authenticated user (the Hive view makes use of impersonation, for which ever system user is running Ambari Server). Best practice is to use LDAP for both Ambari and Ranger, pointing to the same LDAP, so that both systems use the same source of truth for user and group identities.