Member since
12-08-2015
34
Posts
16
Kudos Received
1
Solution
My Accepted Solutions
Title | Views | Posted |
---|---|---|
5911 | 02-29-2016 02:11 AM |
01-15-2016
07:58 AM
1 Kudo
When I allow user1 to read the col1 column in the table on Hive, I will add the following policy to Hive service in Ranger. However, this is not enough in case "Run as end user instead of Hive user = true". I have to add the policy to HDFS service in Ranger. The following table shows the policies at each ACL layer. In this case, user1 can access to the entire table data by hdfs command or hive command without hiveserver2. I think that Ranger support column based ACL in case when "Run as end user instead of Hive user" is true.
... View more
Labels:
- Labels:
-
Apache Ranger
12-16-2015
01:40 AM
Thank you for telling me the url to the Microsoft documentation, but I couldn't find this page. I would like to tell you more information, but I don't know why our AD is like this. So sorry.
... View more
12-15-2015
05:40 AM
1 Kudo
I tried looking up the source code for Ranger Usersync. getUserGroups method in LdapUserGroupBuilder class. groupSearchResultEnum = ldapContext.search(
groupSearchBase,
extendedGroupSearchFilter,
new Object[]{userInfo.getUserFullName()},
groupSearchControls); userInfo.getUserFullName() returns "uid=user1,ou=user,dc=TEST". I suspect this is too long and userInfo.getUserName() method is more appropriate.
... View more
12-14-2015
10:09 AM
1 Kudo
Thank you for telling me the other document. I had tried changing some settings, but I have not solubed yet.
... View more
12-14-2015
08:06 AM
1 Kudo
@Ali Bajwa After restarting Ranger Usersync, I got the below logs. LdapUserGroupBuilder initialization completed with -
ldapAuthenticationMechanism: simple,
searchBase: dc=TEST,
userSearchBase: ou=user,dc=TEST,
userSearchFilter: ,
extendedUserSearchFilter: (objectclass=user),
userNameAttribute: uid,
userSearchAttributes: [uid, memberof, ismemberof],
userGroupNameAttributeSet: [memberof, ismemberof],
groupSearchEnabled: true,
groupSearchBase: ou=group,dc=TEST,
groupSearchFilter: ,
extendedGroupSearchFilter: (&(objectclass=group)(member={0})),
extendedAllGroupsSearchFilter: (&(objectclass=group)),
groupMemberAttributeName: member,
groupNameAttribute: cn, Using LDAP type is AD.
... View more
12-14-2015
07:03 AM
Thank you for your reply and telling me the document. I tried setting "memberof, ismemberof" to "ranger.usersync.ldap.user.groupnameattribute" and restarted Ranger. However, I could not resolve this problem and the logs showed the same content. I will make sure the settings again.
... View more
12-14-2015
06:06 AM
1 Kudo
I'm trying to sync users and groups from LDAP into Ranger using Ranger Usersync. How do I associate the groupname in the group info and the gid in the user and the group info? In my LDAP server, the user info has the gid, but does not have the groupname. I tried LDAP Usersync, but I can't get groupnames. Ranger UI only displaied the gid. I had tried after setting ranger.usersync.group.searchenabled to true, but I could not get groupnames again. The usersync.log showed the folloing logs: INFO LdapUserGroupBuilder [UnixUserSyncThread] - Updating user count: 1, userName: user1, groupList: []
INFO LdapUserGroupBuilder [UnixUserSyncThread] - Updating user count: 2, userName: user2, groupList: []
・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・
INFO LdapUserGroupBuilder [UnixUserSyncThread] - computed groups for user: user1, groups: []
ERROR LdapUserGroupBuilder [UnixUserSyncThread] - sink.addOrUpdateUser failed with exception: org/apache/commons/httpclient/URIException, for user: user1, groups: []
INFO LdapUserGroupBuilder [UnixUserSyncThread] - computed groups for user: user2, groups: []ERROR LdapUserGroupBuilder [UnixUserSyncThread] - sink.addOrUpdateUser failed with exception: org/apache/commons/httpclient/URIException, for user: user2, groups: []
Settings of usersync was as follows : ranger.usersync.source.impl.class = org.apache.ranger.ldapusersync.process.LdapUserGroupBuilder
ranger.usersync.ldap.user.searchscope = sub
ranger.usersync.ldap.user.searchfilter = (space)
ranger.usersync.ldap.user.searchbase = ou=account,dc=TEST
ranger.usersync.ldap.user.objectclass = user
ranger.usersync.group.memberattributename = member
ranger.usersync.group.nameattribute = cn
ranger.usersync.group.objectclass = group
ranger.usersync.group.searchbase = ou=group,dc=TEST
ranger.usersync.group.searchenabled = true
ranger.usersync.group.searchfilter = (space)
ranger.usersync.group.searchscope = (space)
ranger.usersync.ldap.searchBase = dc=TEST
ranger.usersync.ldap.user.groupnameattribute = gidNumber
ranger.usersync.ldap.user.nameattribute = uid The user and group setting is as follows: ・User dn: uid=user1,ou=user,dc=TEST
uid: user1
objectClass: user
uidNumber: 10
gidNumber: 50100
cn: user1
・Group dn: cn=group1,ou=group,dc=TEST
cn: group1
objectClass: group
gidNumber: 50100
member: user1
Please let me know what I should check. Version HDP 2.3.0.0
Ranger 0.5.0.2.3
I have bad English, so I apologize if I say something strange. Thanks.
... View more
Labels:
- Labels:
-
Apache Ranger
12-09-2015
02:42 AM
Thank you for telling me that. I'm looking forward to it.
... View more
12-08-2015
01:12 PM
You are right. My Zookeeper environment is not using a separate znode. I learned much from you. Thank you.
... View more
12-08-2015
08:09 AM
Thank you for your prompt reply!! I had installed in according to the guide you told me. However, some settings were wrong. xasecure.audit.destination.solr.zookeepers for HDFS(ranger-hdfs-audit) was not "none" xasecure.audit.destination.solr.zookeepers for Hive(ranger-hive-audit) was "master:2181/ranger_audits" After fixing these settings, that problem disappeared and I can look audit logs for hive. Thank you so much, Jonas.
... View more
- « Previous
- Next »