Hi, I have a HDP cluster running with AD authentication for Ranger and Zeppelin. I noticed that in order for Hive to be accessible for a given AD user or group which has been allowed by a Ranger ACL, that username/group must exist on the Hive server (eg useradd some-ad-user -G some-ad-group). A similar behavior happens with HDFS access. I can make the Ranger ACL stick by specifying it by username, but not group, without requiring a user to be setup on the name node. The necessity of this of course seems sensible enough. However I'm not uncertain as to the proper means to manage user accounts for each Linux machine. Do I need to mirror every AD account/group on every cluster node, a subset of service nodes, or is there a third option which is correct? It seems to defeat the purpose for me to use active directory if I must manage users/groups across the entire cluster anyway. I thought perhaps Knox is the solution for this, which I'm in the middle of configuring, but I thought I'd ask the question in case the pursuit is fruitless. Thank you.
... View more
