@Cassandra Spencer, the answers are simple: (1) No, it can be any other group. Actually, I don't use this setting, rather set groups per proxy-user (to "*" or particular groups). (2) Human users: No, human users can be in any group. I usually keep service accounts in the hadoop group, like what you plan to do. (3) Ranger will require its own service account, by default called "ranger". It can be in its own group, I use the "hadoop" group. If your cluster is kerberized you'll need one more account usually called "rangerlookup" to facilitate autocompletion of databases, tables etc, with a headless principal and a password (keytab unsupported). The docs talk about a rangerlookup account per service (hdfs, hbase, etc.) but I use only one.
... View more
