CODEWITHSUNDEEP
apache-kafkakerberosambari
Mkt281001
Mkt281001

Reputation: 275

Ranger user sync with kerberos

I have setup Kerberos following below document http://docs.hortonworks.com/HDPDocuments/Ambari-2.2.0.0/bk_Ambari_Security_Guide/content/ch_configuring_amb_hdp_for_kerberos.html

Further, I would like to configure ranger to sync all Kerberos principals to create ACLS. There is an option to sync users from AD but I don't see any option to sync from Kerberos. See options in image below enter image description here Can anyone please help with options for doing this. Thanks

Upvotes: 1

Views: 1442

Answers (1)

Alex
Alex

Reputation: 8937

I'm not sure I understand what exactly you want to import, but I assume you have AD and local cluster KDC which are configured with trusted relations and you want all your principles to be represented in Ranger by standalone user accounts. If you have trusted relations configured that means that your entire list of principles would consist of both local KDC and AD and they all would be valid for authentication. But in ranger you work not with the actual Kerberos principles, but with the usernames, which are obtained from auth_to_local configuration setting according to the mapping rules specified there.

If you are running LDAP sync, it will pass all matching principles through the collection of rules in this configuration property and will create the end user account with names obtained after execution of these rules. You can check the end results using: 

hadoop org.apache.hadoop.security.HadoopKerberosName [email protected]

For local KDC it really does not make sense to pass the principles from KDC through this mapping stage as at the end they all will be mapped to local UNIX accounts. That is why you can just point your group and passwd files in UNIX sync source and you can assume that all your local Kerberos principles would be represented in the Ranger database with proper user accounts.

You can find some more details about the aspects of Kerberos mappings in this article

Upvotes: 1

Related Questions