You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@ranger.apache.org by Arvind S <ar...@gmail.com> on 2015/11/16 11:34:20 UTC
Question regarding "ranger policy User" for HDFS hive etc
My setup has ranger acquiring users from AD.
I am setting up Ranger repositories and have a question on "ranger policy
user(s)".
Whats the suggested mechanism to setup the 'policy user(s)' ..
>Are we to have these policy users created in AD ..import into Ranger and
give them exclusive permissions via ranger policies so that while others
create policy they would be able to get file/ table resources list ?
> Or should we map these users using auth_to_rule into the respective
service accounts like 'hdfs' 'hive' etc ?
Whats best for a production setup?
*Thanks & Cheers !!*
Arvind
Re: Question regarding "ranger policy User" for HDFS hive etc
Posted by Don Bosco Durai <bo...@apache.org>.
Where are the service users? We should have the ranger policy lookup user in the same place. And give this user the required permission in Ranger. That should do.
Bosco
From: Arvind S <ar...@gmail.com>
Reply-To: <us...@ranger.incubator.apache.org>
Date: Monday, November 16, 2015 at 8:23 PM
To: <us...@ranger.incubator.apache.org>
Subject: Re: Question regarding "ranger policy User" for HDFS hive etc
yes cluster is kerberized..and is already using AD.
Cheers !!
Arvind
On Tue, Nov 17, 2015 at 2:11 AM, Don Bosco Durai <bo...@apache.org> wrote:
Arvind
Does your env as Kerberos?
Bosco
From: Arvind S <ar...@gmail.com>
Reply-To: <us...@ranger.incubator.apache.org>
Date: Monday, November 16, 2015 at 2:34 AM
To: <us...@ranger.incubator.apache.org>
Subject: Question regarding "ranger policy User" for HDFS hive etc
My setup has ranger acquiring users from AD.
I am setting up Ranger repositories and have a question on "ranger policy user(s)".
Whats the suggested mechanism to setup the 'policy user(s)' ..
>Are we to have these policy users created in AD ..import into Ranger and give them exclusive permissions via ranger policies so that while others create policy they would be able to get file/ table resources list ?
> Or should we map these users using auth_to_rule into the respective service accounts like 'hdfs' 'hive' etc ?
Whats best for a production setup?
Thanks & Cheers !!
Arvind
Re: Question regarding "ranger policy User" for HDFS hive etc
Posted by Arvind S <ar...@gmail.com>.
yes cluster is kerberized..and is already using AD.
*Cheers !!*
Arvind
On Tue, Nov 17, 2015 at 2:11 AM, Don Bosco Durai <bo...@apache.org> wrote:
> Arvind
>
> Does your env as Kerberos?
>
> Bosco
>
>
>
> From: Arvind S <ar...@gmail.com>
> Reply-To: <us...@ranger.incubator.apache.org>
> Date: Monday, November 16, 2015 at 2:34 AM
> To: <us...@ranger.incubator.apache.org>
> Subject: Question regarding "ranger policy User" for HDFS hive etc
>
> My setup has ranger acquiring users from AD.
> I am setting up Ranger repositories and have a question on "ranger policy
> user(s)".
> Whats the suggested mechanism to setup the 'policy user(s)' ..
>
> >Are we to have these policy users created in AD ..import into Ranger and
> give them exclusive permissions via ranger policies so that while others
> create policy they would be able to get file/ table resources list ?
>
> > Or should we map these users using auth_to_rule into the respective
> service accounts like 'hdfs' 'hive' etc ?
>
> Whats best for a production setup?
>
> *Thanks & Cheers !!*
> Arvind
>
>
Re: Question regarding "ranger policy User" for HDFS hive etc
Posted by Don Bosco Durai <bo...@apache.org>.
Arvind
Does your env as Kerberos?
Bosco
From: Arvind S <ar...@gmail.com>
Reply-To: <us...@ranger.incubator.apache.org>
Date: Monday, November 16, 2015 at 2:34 AM
To: <us...@ranger.incubator.apache.org>
Subject: Question regarding "ranger policy User" for HDFS hive etc
My setup has ranger acquiring users from AD.
I am setting up Ranger repositories and have a question on "ranger policy user(s)".
Whats the suggested mechanism to setup the 'policy user(s)' ..
>Are we to have these policy users created in AD ..import into Ranger and give them exclusive permissions via ranger policies so that while others create policy they would be able to get file/ table resources list ?
> Or should we map these users using auth_to_rule into the respective service accounts like 'hdfs' 'hive' etc ?
Whats best for a production setup?
Thanks & Cheers !!
Arvind