@wbivp Within Ranger you can authorizer users and/or groups to the policies you define. The Ranger plugin with the NiFi service runs in the background within NiFi that connects with Ranger to download the latest set of policies. What is provided by Ranger is simply user(s) A, B, C strings and/or group(s) X, Y, Z strings are authorized read and/or write to NiFi Resource Identifier(s). There is nothin in what is downloaded from Ranger that will tell NiFi as the client what users belong to group(s) X, Y, or Z. This means that NiFi itself needs to be aware of these associations. This is why in the nifi-user.log you see the following: o.a.n.w.a.c.AccessDeniedExceptionMapper identity[test.username], groups[] does ... This log line tells us that NiFi is unaware of any groups the the authenticated user string "test.username" is a member. If NiFi was aware the "groups[]" in this log line would show a comma separated list of all these group strings. NiFi offers numerous user-group-providers that can be added to the authorizers.xml that allow these associations between user and groups to be set. Your authorizers.xml file shared contains the "cm-user-group-provider" (only used to assign NiFi node hostnames to a group string "nifi") and the "file-user-group-provider" [1] which gives users a way of manually adding group strings and associating users to that group directly from the NiFi UI. So with your current setup, you would login as your authorized user, go to the NiFi Global Menu, and then select "users". This will open the NiFi Users UI where you should see your initial admin user which you defined in your file-user-group-provider. You would need to click on the icon to add additional users and groups manually. Adding users and groups here has nothing to do with authentication. You are using this Ui to establish user to group associations. So I would start by creating a new group. The Identity string used must match case sensitive the exact group string as seen in Ranger. Then you can start adding your user strings (must match user strings case sensitive as seen in Ranger) As you add users you will be able to select the group(s) you added as those that user should be associated with. Using above as an example, NiFi would then associate user string "JoeSmith" with group string "admins". To see what other user-group-providers exist within your NiFi version, you should look at the "Admin Guide" found under help within your NiFi's embedded documentation access via the UI. A very commonly used user-group-provider is the "ldap-user-group-provider" [2] which can be used to sync user and groups strings from LDAP/AD and establish the associations between them based on what is in LDAP/AD. [1] https://nifi.apache.org/docs/nifi-docs/html/administration-guide.html#fileusergroupprovider [2] https://nifi.apache.org/docs/nifi-docs/html/administration-guide.html#ldapusergroupprovider If you found these responses assisted with your query, please take a moment to login and click on "Accept as Solution" below each post. Thank you, Matt
... View more
