Re: ranger doesn't show resource based policies

vperiasamy · ‎11-15-2018

Looks like user does not have the right access in ranger.

vperiasamy · ‎11-15-2018

Please look at import API. http://ranger.apache.org/apidocs/resource_ServiceREST.html#resource_ServiceREST_importPoliciesFromFile_POST

vperiasamy · ‎11-05-2018

They are created during the component restart after ranger plugin is enabled. Check ambari console logs for the component (hdfs, hive etc) restarts to find out repo creation messages.

vperiasamy · ‎10-25-2018

This is probably similar to https://issues.apache.org/jira/browse/RANGER-2234. Please set auto increment value in your mysql conf to 1.

vperiasamy · ‎09-26-2018

Can you post the error?

vperiasamy · ‎09-26-2018

This seems to be caused by Ambari script not being able to talk to Ranger. Can you check the external URL defined in Ranger config?

vperiasamy · ‎09-26-2018

EZK ==> Encryption Zone Key. Keys generated by users to encrypt encryption zones are EZKs. Not sure what you are asking below. >> is it possible to programmatically determine that Master Key and EZKs are correct >> is it possible to encrypt Master Key within Service Master Key and password?

vperiasamy · ‎09-05-2018

Ranger KMS and Hive workloads will continue to work even when Ranger is down. They will use the local cache of ranger policies downloaded from Ranger. Each plugin pulls the policies periodically (default 30 sec) from Ranger. *** If you found this answer addressed your question, please take a moment to login and click the "accept" link on the answer.

vperiasamy · ‎09-05-2018

-- Master key and EZK are stored in DB. -- If keys can be created and encryption zones can be setup successfully that is an indication. -- Postgres DB backup is a recommended way to backup keys stored in DB. *** If you found this answer addressed your question, please take a moment to login and click the "accept" link on the answer.

vperiasamy · ‎09-05-2018

How many ranger admin instances are there? Looks like the install was triggered from more than one which caused this situation. I would suggest the below. -- Remove entry for PatchTagModulePermission_J10005 from x_db_version_h table -- Start only one ranger admin instance (at least to isolate this issue). -- Once the install is successful, you can start the other ranger admin instances. *** If you found this answer addressed your question, please take a moment to login and click the "accept" link on the answer.

vperiasamy · ‎06-12-2018

What version of HDP is used here? In kerberos env, there is no need to setup 2-way SSL (from HDP 2.5 onwards). If kerberos is not used, 2-way SSL is required between Ranger plugins and Ranger Admin. Please refer https://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.6.5/bk_security/content/configure_hbase_plugin_ssl.html

vperiasamy · ‎06-04-2018

HDP 2.6.4 should already have this fix, which was already back ported to HDP 2.6.3. https://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.6.3/bk_release-notes/content/fixed_issues.html

vperiasamy · ‎05-15-2018

See https://issues.apache.org/jira/browse/HIVE-6415. Transform clause is disallowed.

vperiasamy · ‎05-15-2018

What kind of integration are you planning?

vperiasamy · ‎05-15-2018

Yes, and having the DB on its own host is recommended if possible.

vperiasamy · ‎05-08-2018

This error means Ranger usersync is not able to communicate to Ranger admin to sync the users. Usersync uses kerberos to communicate to Ranger Admin. Make sure you have all the right keytabs for ranger components (if not, regenerate keytabs from Ambari) and the keytab files have right principals and permissions. Check for any errors in both usersync logs and ranger admin logs (are there any errors related to spnego keytab?)

vperiasamy · ‎04-27-2018

Also take a look at https://community.hortonworks.com/content/supportkb/150187/unable-to-view-ranger-audit-when-ssl-is-enabled-on.html

vperiasamy · ‎04-27-2018

Can you please take a look at the instructions in https://community.hortonworks.com/content/kbentry/92987/setup-ranger-to-use-ambari-infra-solr-enabled-in-s.html

vperiasamy · ‎04-27-2018

@Abhilash Chandra 1. requestUser is a query parameter for the rest call, so there is no way to pass "<>". You would have to script from your end to see data for users you are interested in. 2. Yes, Ranger provides data in JSON format. You can present it as you like outside of Ranger. 3. From within Ranger UI, you should be able to use Access Audit tab to apply these filters on audit data.

vperiasamy · ‎04-27-2018

yes, you can explore using that.

vperiasamy · ‎04-27-2018

yes, that is true. Above Ambari patch mentioned was back-ported to Ambari used with IOP 4.2.5.

vperiasamy · ‎04-27-2018

Do you have SSL enabled for Ranger?

vperiasamy · ‎04-27-2018

Yes, the java patches are required to accommodate the changes in new versions.

vperiasamy · ‎04-27-2018

You can probably use /service/access/accessAudit api. Please note the parameter requestUser. For example... curl -k -i --header "Accept:application/json" -H "Content-Type: application/json" --user admin:admin -X GET "http://localhost:6080/service/assets/accessAudit?page=0&pageSize=25&startIndex=0&sortBy=eventTime&startDate=04%2F27%2F2018&requestUser=hive"

vperiasamy · ‎04-27-2018

I don't think there is any straight way to get what you are looking for. May be you can query Ambari to get the status of the services?

vperiasamy · ‎04-03-2018

AMBARI-18425 will be available in Ambari 2.7.0 (to be released). In the meanwhile, if using Ambari 2.6.x (with HDP 2.6.x), set the authentication method as UNIX and add a custom property ranger.pam.authentication.enabled in ranger-admin-site.xml and set it to true.

vperiasamy · ‎04-02-2018

This is because of the Ambari version used, which will be addressed in the next version. https://issues.apache.org/jira/browse/AMBARI-18425

vperiasamy · ‎04-02-2018

Can you check if there are any errors in ranger admin logs? That should give clue on why repository creation failed.

vperiasamy · ‎03-20-2018

This functionality is not available. I am still not sure why this is required, because you can load the whole HDFS logs into a hive table and do analysis. If you'd like to store only a particular user's activity, you can perform the filtering when loading this data. If you store a second copy, it is just going to take more space.

vperiasamy · ‎03-19-2018

Ranger stores all audit logs in Solr (for showing in Ranger UI) and in HDFS (for long-term archive). Could you please elaborate on why what you are asking is required?

Online	Offline
Last Visited	‎05-03-2022 12:07 PM

Date Registered	‎09-10-2015 10:36 PM
Last Visited	‎05-03-2022 12:07 PM
Total Messages Posted	261
Total Kudos Received	84

Re: ranger doesn't show resource based policies

Re: Ranger and Ranger-Kms relation

Re: "Java patch PatchPasswordEncryption_J10001 is ...

Re: Unable to log storm audit events to hdfs (sand...

Re: ranger user sync from text file

Re: ranger doesn't show resource based policies

Re: Ranger Update Multiple Policies via REST API

Re: Ranger Service Repos not being automatically c...

Re: Ranger Admin installation is failing in HDP-3....

Re: Ranger Admin failing to start when trying to c...

Re: Unable to start Hive-server2 with ranger-hive ...

Re: Ranger kms key management and verification

Re: Ranger and Ranger-Kms relation

Re: Ranger kms key management and verification

Re: HDP behind proxy - Ranger Admin doesn't start

Re: Hbase master fails to start after enabling ran...

Re: Ranger 1.0 Upgrade (HDP 2.6.4)

Re: Hive transform disallowed

Re: INFORMATICA BDM integrate with Atlas and Range...

Re: Is it possible to have Ranger admin ui on one ...

Re: HDP and Kerbrose UserSync problems

Re: Ranger Audit unable to query the Solr

Re: Ranger Audit unable to query the Solr

Re: Ranger SOLR Access log to only contain activit...

Re: How to send Ranger Logs to Log Analytics(OMS) ...

Re: Why PAM authentication for Ranger doesn't exis...

Re: Ranger Load Balancer URL not working after ker...

Re: What are these java patches getting applied at...

Re: Ranger SOLR Access log to only contain activit...

Re: ranger rest api to get details of Ranger Plugi...

Re: Why PAM authentication for Ranger doesn't exis...

Re: Why PAM authentication for Ranger doesn't exis...

Re: Error creating Ranger repository after kerbero...

Re: Ranger audit logs copy to a local directory fo...

Re: Ranger audit logs copy to a local directory fo...