1) Can i create Ranger DB's on existing Postgres Ambari DB and then provide DB configuration during Ambari installatio. Is that a viable solution? >> yes you can use existing postgres ambari db and configure it while installing ranger, 2) Does kerberos needs to be setup before installing Ranger/Ranger KMS or is there a way to set up Ranger/Ranger KMS on non kerborized cluster? -> you can setup ranger/ranger kms on non kerborized cluster , that will not be a problem , but it is recommended to have security + ranger. ... View more

1) Can i use the same PostgreSQL DB for creating ranger Audit and Policy DB's? >> audit to db support is removed hdp-2.5 onwards, only audit to solr and audit to hdfs is supported , but you can use MSSQL as policy DB , 2) I already have Ambari Infra installed on Cluster? Do i need to use URL as http://solr_host:6083/solr/ranger_audits? where solr_host will be the hostname of machine where Ambari Metrics is installed? >> if ambari infra is installed and you select Audit to solr options, then select solr cloud option and ambari infra/solr url will automatically populate 3) Do we need to setup Knox with kerberos before installing Ranger or can it be done later as well? >> knox is not the dependency for ranger , so it can be done later also. ... View more

yes surya it was one way ssl ... View more

new policy download api call will be used if it is secure cluster , in access log you can check which call is used it should be similar to /service/plugins/secure/policies/download/ ... View more

actually either there was something wrong in my clsuter or I had not restarted the knox after adding hive cert to the knox trust cacert. because after i lost the clsuter and created the new cluster and after doing necessary steps it worked, accepting your answer because the problem you shared was real issue that i had faced earlier with webhdfs , and was seeing the such issue. ... View more

Edgar Daeds I think most of things seems to be good in your cluster, we need to go more in depth to find the issue , please provide following info: 1) access log in ranger admin, where we will see entries for each policy download call, there we will be seeing some error i guess. 2) then try to do kinit using hdfs keytab and perform the policy download call manually. ... View more

can you also post value of hadoop.security.auth_to_local, because i see nn/hadoop1.locald@EXAMPLE.COM , it should be RULE:[2:$1@$0](nn@EXAMPLE.COM)s/.*/hdfs ... View more

Wanted to know which hdp version is this ? ... View more

you can give password of hdfs user , but that will not matter because in secure env keytab will be used , so just configure hdfs user and something in password it should work then ... View more

and can you please change the repo user to hdfs if it is something else ... View more