You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@hawq.apache.org by lisakowen <gi...@git.apache.org> on 2017/07/12 17:52:03 UTC

[GitHub] incubator-hawq-docs pull request #128: HAWQ-1479 - doc ranger kerberos integ...

GitHub user lisakowen opened a pull request:

    https://github.com/apache/incubator-hawq-docs/pull/128

    HAWQ-1479 - doc ranger kerberos integration

    document ranger kerberos integration:
    - remove kerberos limitation
    - update ranger integ/config to include new enable-ranger-plugin.sh kerberos options, call out kerberos diffs, and link to new ranger/kerberos integration page
    - new ranger/kerberos integration page identifying config procedures for 
      - RPS -> Kerberized Ranger (policy checking)
      - Ranger -> Kerberized HAWQ (resource lookup)
    - call out any HA considerations with respect to ranger - not sure if i got everything

You can merge this pull request into a Git repository by running:

    $ git pull https://github.com/lisakowen/incubator-hawq-docs feature/ranger-kerb

Alternatively you can review and apply these changes as the patch at:

    https://github.com/apache/incubator-hawq-docs/pull/128.patch

To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:

    This closes #128
    
----
commit 566fb8181acbe80ce0954fbc5215a9fc18932382
Author: Lisa Owen <lo...@pivotal.io>
Date:   2017-07-05T23:37:13Z

    HAWQ-1479 - doc ranger kerberos integration

----


---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---

[GitHub] incubator-hawq-docs pull request #128: HAWQ-1479 - doc ranger kerberos integ...

Posted by dyozie <gi...@git.apache.org>.

Github user dyozie commented on a diff in the pull request:

https://github.com/apache/incubator-hawq-docs/pull/128#discussion_r127074583

"When Kerberos is enabled for Ranger" -> "**If** Kerberos is enabled for Ranger"

---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---

[GitHub] incubator-hawq-docs pull request #128: HAWQ-1479 - doc ranger kerberos integ...

Posted by interma <gi...@git.apache.org>.

Github user interma commented on a diff in the pull request:

https://github.com/apache/incubator-hawq-docs/pull/128#discussion_r127157041

--- Diff: markdown/ranger/ranger-kerberos.html.md.erb ---
@@ -0,0 +1,209 @@
+---
+title: HAWQ Ranger Kerberos Integration
+---
+
+
+
+When you have enabled Ranger Authorization for HAWQ, your HAWQ installation includes the Ranger Administrative UI and HAWQ Ranger Plug-in Service.
+
+Specific HAWQ Ranger configuration is required when Kerberos authentication is enabled for HAWQ or for Ranger. You must configure Kerberos support for:
+
+- HAWQ resource lookup by the Ranger Administration host during HAWQ policy definition
+- HAWQ Ranger Plug-in Service communication with the Ranger Administration host for policy refresh
+
+Use the following procedures to configure Kerberos support for your Ranger-authorized HAWQ cluster.
+
+## Prerequisites <a id="kerb_ranger_prereq"></a>
+
+Before you configure Kerberos for your Ranger-authorized HAWQ cluster, ensure that you have:
+
+- Installed Java 1.7.0\_17 or later on all nodes in your cluster. Java 1.7.0_17 is required to use Kerberos-authenticated JDBC on Red Hat Enterprise Linux 6.x or 7.x.
+- (Non-OpenJDK Java installations) Installed the Java Cryptography Extension (JCE) on all nodes in your cluster.
+ - If you manage your cluster with Ambari, you installed the JCE on each node before you enabled Kerberos with the Ambari **Kerberos Security Wizard**.
+ - If you manage your cluster from the command line, you must manually install the extension on these systems.
+- Noted the host name or IP address of your Ranger Administration host (\<ranger-admin-node\>) and HAWQ master (\<master\>) nodes.
+- Identified an existing Kerberos Key Distribution Center (KDC) or set up your KDC as described in [Install and Configure a Kerberos KDC Server](../clientaccess/kerberos.html#task_setup_kdc).
+ - Note the host name or IP address of your KDC (\<kdc-server\>).
+ - Note the name of the Kerberos \<realm\> in which your cluster resides.
+- Enabled Ranger Authorization for HAWQ. See [Configuring HAWQ to use Ranger Policy Management](ranger-integration-config.html).
+
+
+## Configure Ranger for Kerberized HAWQ<a id="ra2hawq_kerb_cfg"></a>
+
+When you define HAWQ Ranger authorization policies, the Ranger Administration Host uses JDBC to connect to HAWQ during policy definition to look up policy resource names. When Kerberos user authentication is enabled for HAWQ, you must configure this connection for Kerberos.
+
+To configure Ranger access to a HAWQ cluster enabled with Kerberos user authentication, you must:
+
+- Identify an existing HAWQ administrative role or create a new HAWQ administrative role for Ranger lookup of HAWQ resources
+- Create a Kerberos principal for the lookup role
+- Update the Ranger HAWQ service definition
+
+### Procedure <a id="kerb_ra2hawq_proc"></a>
+
+Perform the following procedure to enable the Ranger Administration Host to look up resources in your kerberized HAWQ cluster. You will perform operations on the HAWQ \<master\>, \<ranger-admin-node\>, and \<kdc-server\> nodes.
+
+1. Log in to the HAWQ master node and set up your environment:
+
+ ``` shell
+ $ ssh gpadmin@<master>
+ gpadmin@master$ . /usr/local/hawq/greenplum_path.sh
+ ```
+
+2. Identify an existing HAWQ administrative role or create a new HAWQ administrative role for Ranger resource lookup. For example, to create a new administrative role:
+
+ ``` shell
+ gpadmin@master$ psql -c 'CREATE ROLE "rangerlookup_hawq" with LOGIN SUPERUSER;'
+ ```
+
+ You may choose a different name for the Ranger lookup role.
+
+3. Log in to the KDC server system and generate a principal for the HAWQ `rangerlookup_hawq` role. Substitute your Kerberos \<realm\>. For example:
+
+ ``` shell
+ $ ssh root@<kdc-server>
+ root@kdc-server$ kadmin.local -q "addprinc -pw changeme rangerlookup_hawq@REALM.DOMAIN"
+ ```
+
+ You do not need to generate a keytab file for the `rangerlookup_hawq` principal because you will provide the password in the HAWQ service definition of the Ranger Admin UI.
+
+4. Start the Ranger Admin UI in a supported web browser. The default URL is \<ranger-admin-node\>:6080.
+
+5. Locate the HAWQ service definition and click the **Edit** button.
+
+6. Update the applicable **Config Properties** fields:
+
+ **HAWQ User Name*** : Enter the HAWQ Ranger lookup role you identified or created in Step 2 above.
+ **HAWQ User Password*** : Enter the password you assigned to the HAWQ Ranger lookup role principal.
+ **HAWQ Kerberos Service Name** : Enter `postgres` or your custom HAWQ service name.
+
+7. Click the **Test Connection** button. If you connect successfully, Ranger displays a dialog with the message:
+
+ ``` pre
+ Connected Successfully.
+ ```
+
+ You successfully configured Ranger to use Kerberos authentication when looking up HAWQ resource names.
+
+8. **Save** your changes to permanently configure Kerberos authentication for HAWQ Ranger resource lookup.
+
+
+## Configure HAWQ for Kerberized Ranger<a id="rps2ra_kerb_cfg"></a>
+
+When Ranger Authorization is enabled for HAWQ, the Ranger Plug-in Service fetches policies from the Ranger Administration host. If Kerberos is enabled for Ranger, you must specifically configure the Ranger Plug-in Service for this communication.
+
+This procedure includes:
+
+- Adding an administrative Ranger user named `postgres`
+- Updating the HAWQ Ranger Plug-in Service configuration to utilize Kerberos
+- Updating the HAWQ service definition in the Ranger Admin UI
+
+
+### Procedure <a id="kerb_rps2ra_proc"></a>
+
+Perform the following steps to enable Ranger Plug-in Service policy refresh from a kerberized Ranger:
+
+1. Create a `postgres` Ranger administrative user.
+
+ 1. Open the Ranger Admin UI. The default URL is \<ranger-admin-node\>:6080.
+ 2. Navigate to **Settings > Users/Groups**.
+ 3. Click the **Add New User** button.
+ 4. Fill out the required fields in the **User Detail** dialog:
+
+ **User Name*** : Enter `postgres`.
+ **New Password*** : Enter the user's password.
+ **Password Confirm*** : Enter the password again.
+ **First Name*** : Enter the first name of the user.
+ **Select Role*** : Select the **Admin** role.
+
+2. Update the HAWQ Ranger Plug-in Service configuration to use Kerberos authentication when communicating with Ranger.
+
+ 2. Edit the HAWQ Ranger Plug-in Service `rps.properties` configuration file and set the `RPS_AUTH` property to specify Kerberos authentication.
+
+ ``` shell
+ gpadmin@master$ vi $GPHOME/ranger/etc/rps.properties
+ ```
+
+ ``` pre
+ RPS_AUTH=kerberos
+ ```
+
+ 3. `rps.properties` also includes `RPS_PRINCIPAL` and `RPS_KEYTAB` properties. If these properties are unset, the Ranger Plug-in Service uses the cached Kerberos credentials that are available for the HAWQ runtime user account (typically `gpadmin`). Set these properties if the default values are not appropriate for your environment.
+
+3. Stop the Ranger Plug-in Service:
+
+ ``` shell
+ gpadmin@master$ $GPHOME/ranger/bin/rps.sh stop
+ ```
+
+4. Generate a ticket for the `postgres@<realm>` principal:
+
+ ``` shell
+ gpadmin@master$ kinit -kt /etc/security/keytabs/hawq.service.keytab postgres@REALM.DOMAIN
+ ```
+
+5. Restart the HAWQ Ranger Plug-in Service:
+
+ ``` shell
+ gpadmin@master$ $GPHOME/ranger/bin/rps.sh start
+ ```
+
+6. If you have enabled HAWQ Ranger High Availability, synchronize the HAWQ Ranger Plug-in Service configuration files from the HAWQ master node to the standby master node as described in the [Register a Standby Ranger Plug-in Service](ranger-integration-config.html#rps_ha_cfg_standbyrps) procedure, including restarting the standby master node.
+
+7. Navigate to the Ranger Admin UI in a supported web browser. The default URL is \<ranger-admin-node\>:6080.
+
+8. Locate the **HAWQ** service definition and click the **Edit** button.
+
+9. Update the applicable **Config Properties** fields:
+
+ **HAWQ Authentication Type** : Select **Kerberos** from the drop-down list.
+ **HAWQ Kerberos Service Name** : Enter `postgres` or your custom HAWQ service name.
+
+10. **Save** your changes to permanently configure Kerberos authentication for Ranger policy retrieval.
--- End diff --

I am a little confused: what's effects the of step7~step10？
These steps are only needed in Ranger->HAWQ (in above section), no needed in this HAWQ/RPS->Ranger section.

Right? Or do I missing something that you had communicated before?
Thanks!

[GitHub] incubator-hawq-docs pull request #128: HAWQ-1479 - doc ranger kerberos integ...

Posted by dyozie <gi...@git.apache.org>.

Github user dyozie commented on a diff in the pull request:

https://github.com/apache/incubator-hawq-docs/pull/128#discussion_r127074846

Updating **the** HAWQ Ranger ...

[GitHub] incubator-hawq-docs pull request #128: HAWQ-1479 - doc ranger kerberos integ...

Posted by dyozie <gi...@git.apache.org>.

Github user dyozie commented on a diff in the pull request:

https://github.com/apache/incubator-hawq-docs/pull/128#discussion_r127078185

--- Diff: markdown/ranger/ranger-kerberos.html.md.erb ---
@@ -0,0 +1,209 @@
+---
+title: HAWQ Ranger Kerberos Integration
+---
+
+
+
+When you have enabled Ranger Authorization for HAWQ, your HAWQ installation includes the Ranger Administrative UI and HAWQ Ranger Plug-in Service.
+
+Specific HAWQ Ranger configuration is required when Kerberos authentication is enabled for HAWQ or for Ranger. You must configure Kerberos support for:
+
+- HAWQ resource lookup by the Ranger Administration host during HAWQ policy definition
+- HAWQ Ranger Plug-in Service communication with the Ranger Administration host for policy refresh
+
+Use the following procedures to configure Kerberos support for your Ranger-authorized HAWQ cluster.
+
+## Prerequisites <a id="kerb_ranger_prereq"></a>
+
+Before you configure Kerberos for your Ranger-authorized HAWQ cluster, ensure that you have:
+
+- Installed Java 1.7.0\_17 or later on all nodes in your cluster. Java 1.7.0_17 is required to use Kerberos-authenticated JDBC on Red Hat Enterprise Linux 6.x or 7.x.
+- (Non-OpenJDK Java installations) Installed the Java Cryptography Extension (JCE) on all nodes in your cluster.
+ - If you manage your cluster with Ambari, you installed the JCE on each node before you enabled Kerberos with the Ambari **Kerberos Security Wizard**.
+ - If you manage your cluster from the command line, you must manually install the extension on these systems.
+- Noted the host name or IP address of your Ranger Administration host (\<ranger-admin-node\>) and HAWQ master (\<master\>) nodes.
+- Identified an existing Kerberos Key Distribution Center (KDC) or set up your KDC as described in [Install and Configure a Kerberos KDC Server](../clientaccess/kerberos.html#task_setup_kdc).
+ - Note the host name or IP address of your KDC (\<kdc-server\>).
+ - Note the name of the Kerberos \<realm\> in which your cluster resides.
+- Enabled Ranger Authorization for HAWQ. See [Configuring HAWQ to use Ranger Policy Management](ranger-integration-config.html).
+
+
+## Configure Ranger for Kerberized HAWQ<a id="ra2hawq_kerb_cfg"></a>
+
+When you define HAWQ Ranger authorization policies, the Ranger Administration Host uses JDBC to connect to HAWQ during policy definition to look up policy resource names. When Kerberos user authentication is enabled for HAWQ, you must configure this connection for Kerberos.
+
+To configure Ranger access to a HAWQ cluster enabled with Kerberos user authentication, you must:
+
+- Identify an existing HAWQ administrative role or create a new HAWQ administrative role for Ranger lookup of HAWQ resources
+- Create a Kerberos principal for the lookup role
+- Update the Ranger HAWQ service definition
+
+### Procedure <a id="kerb_ra2hawq_proc"></a>
+
+Perform the following procedure to enable the Ranger Administration Host to look up resources in your kerberized HAWQ cluster. You will perform operations on the HAWQ \<master\>, \<ranger-admin-node\>, and \<kdc-server\> nodes.
+
+1. Log in to the HAWQ master node and set up your environment:
+
+ ``` shell
+ $ ssh gpadmin@<master>
+ gpadmin@master$ . /usr/local/hawq/greenplum_path.sh
+ ```
+
+2. Identify an existing or create a new HAWQ administrative role for Ranger resource lookup. For example, to create a new administrative role:
+
+ ``` shell
+ gpadmin@master$ psql -c 'CREATE ROLE "rangerlookup_hawq" with LOGIN SUPERUSER;'
+ ```
+
+ You may choose a different name for the Ranger lookup role.
+
+3. Log in to the KDC server system and generate a principal for the HAWQ `rangerlookup_hawq` role. Substitute your Kerberos \<realm\>. For example:
+
+ ``` shell
+ $ ssh root@<kdc-server>
+ root@kdc-server$ kadmin.local -q "addprinc -pw changeme rangerlookup_hawq@REALM.DOMAIN"
+ ```
+
+ You do not need to generate a keytab file for the `rangerlookup_hawq` principal because you will provide the password in the HAWQ service definition of the Ranger Admin UI.
+
+4. Start the Ranger Admin UI in a supported web browser. The default URL is \<ranger-admin-node\>:6080.
+
+5. Locate the HAWQ service definition and press the **Edit** button.
+
+6. Update the applicable **Config Properties** fields:
+
+ **HAWQ User Name*** - The HAWQ Ranger lookup role you identified or created in Step 2 above.
+ **HAWQ User Password*** - The password you assigned to the HAWQ Ranger lookup role principal.
+ **HAWQ Kerberos Service Name** - `postgres`
+
+7. Click the **Test Connection** button. If you connect successfully, Ranger displays a dialog with the message:
+
+ ``` pre
+ Connected Successfully.
+ ```
+
+ You successfully configured Ranger to use Kerberos authentication when looking up HAWQ resource names.
+
+8. **Save** your changes to permanently configure Kerberos authentication for HAWQ Ranger resource lookup.
+
+
+## Configure HAWQ for Kerberized Ranger<a id="rps2ra_kerb_cfg"></a>
+
+When Ranger Authorization is enabled for HAWQ, the Ranger Plug-in Service fetches policies from the Ranger Administration host. When Kerberos is enabled for Ranger, you must specifically configure the Ranger Plug-in Service for this communication.
+
+This procedure includes:
+
+- Adding an administrative Ranger user named `postgres`
+- Updating HAWQ Ranger Plug-in Service configuration to utilize Kerberos
+- Updating the HAWQ service definition in the Ranger Admin UI
+
+
+### Procedure <a id="kerb_rps2ra_proc"></a>
+
+Perform the following steps to enable Ranger Plug-in Service policy refresh from a kerberized Ranger:
+
+1. Create a `postgres` Ranger administrative user.
+
+ 1. Open the Ranger Admin UI. The default URL is \<ranger-admin-node\>:6080.
+ 2. Navigate to **Settings > Users/Groups**.
+ 3. Press the **Add New User** button.
+ 4. Fill out the required fields in the **User Detail** dialog:
+
+ **User Name*** - `postgres`
+ **New Password*** - The user's password ?? IS THIS SIGNIFICANT ??
+ **Password Confirm*** - Enter the password again
+ **First Name*** - The first name of the user
+ **Select Role*** - Select the **Admin** role
+
+2. Update the HAWQ Ranger Plug-in Service configuration to use Kerberos authentication when communicating with Ranger.
+
+ 2. Edit the HAWQ Ranger Plug-in Service `rps.properties` configuration file and set the `RPS_AUTH` property to specify Kerberos authentication.
+
+ ``` shell
+ gpadmin@master$ vi $GPHOME/ranger/etc/rps.properties
+ ```
+
+ ``` pre
+ RPS_AUTH=kerberos
+ ```
+
+ 3. `rps.properties` also includes `RPS_PRINCIPAL` and `RPS_KEYTAB` properties. If unset, the Ranger Plug-in Service uses the Kerberos credentials cache in place for the HAWQ runtime user account (typically `gpadmin`). Set these properties if the default values are not appropriate for your environment.
+
+3. Stop the Ranger Plug-in Service:
+
+ ``` shell
+ gpadmin@master$ $GPHOME/ranger/bin/rps.sh stop
+ ```
+
+4. Generate a ticket for the `postgres@<realm>` principal:
+
+ ``` shell
+ gpadmin@master$ kinit -kt /etc/security/keytabs/hawq.service.keytab postgres@REALM.DOMAIN
+ ```
+
+5. Restart the HAWQ Ranger Plug-in Service:
+
+ ``` shell
+ gpadmin@master$ $GPHOME/ranger/bin/rps.sh start
+ ```
+
+6. If you have enabled HAWQ Ranger High Availability, synchronize the HAWQ Ranger Plug-in Service configuration files from the HAWQ master node to the standby master node as described in the [Register a Standby Ranger Plug-in Service](ranger-integration-config.html#rps_ha_cfg_standbyrps) procedure, including restarting the standby master node.
+
+7. Navigate to the Ranger Admin UI in a supported web browser. The default URL is \<ranger-admin-node\>:6080.
+
+8. Locate the **HAWQ** service definition and press the **Edit** button.
+
+9. Update the applicable **Config Properties** fields:
+
+ **HAWQ Authentication Type** - Select **Kerberos** from the drop-down list
--- End diff --

Same edits as above.

[GitHub] incubator-hawq-docs pull request #128: HAWQ-1479 - doc ranger kerberos integ...

Posted by dyozie <gi...@git.apache.org>.

Github user dyozie commented on a diff in the pull request:

https://github.com/apache/incubator-hawq-docs/pull/128#discussion_r127075166

--- Diff: markdown/ranger/ranger-kerberos.html.md.erb ---
@@ -0,0 +1,209 @@
+---
+title: HAWQ Ranger Kerberos Integration
+---
+
+
+
+When you have enabled Ranger Authorization for HAWQ, your HAWQ installation includes the Ranger Administrative UI and HAWQ Ranger Plug-in Service.
+
+Specific HAWQ Ranger configuration is required when Kerberos authentication is enabled for HAWQ or for Ranger. You must configure Kerberos support for:
+
+- HAWQ resource lookup by the Ranger Administration host during HAWQ policy definition
+- HAWQ Ranger Plug-in Service communication with the Ranger Administration host for policy refresh
+
+Use the following procedures to configure Kerberos support for your Ranger-authorized HAWQ cluster.
+
+## Prerequisites <a id="kerb_ranger_prereq"></a>
+
+Before you configure Kerberos for your Ranger-authorized HAWQ cluster, ensure that you have:
+
+- Installed Java 1.7.0\_17 or later on all nodes in your cluster. Java 1.7.0_17 is required to use Kerberos-authenticated JDBC on Red Hat Enterprise Linux 6.x or 7.x.
+- (Non-OpenJDK Java installations) Installed the Java Cryptography Extension (JCE) on all nodes in your cluster.
+ - If you manage your cluster with Ambari, you installed the JCE on each node before you enabled Kerberos with the Ambari **Kerberos Security Wizard**.
+ - If you manage your cluster from the command line, you must manually install the extension on these systems.
+- Noted the host name or IP address of your Ranger Administration host (\<ranger-admin-node\>) and HAWQ master (\<master\>) nodes.
+- Identified an existing Kerberos Key Distribution Center (KDC) or set up your KDC as described in [Install and Configure a Kerberos KDC Server](../clientaccess/kerberos.html#task_setup_kdc).
+ - Note the host name or IP address of your KDC (\<kdc-server\>).
+ - Note the name of the Kerberos \<realm\> in which your cluster resides.
+- Enabled Ranger Authorization for HAWQ. See [Configuring HAWQ to use Ranger Policy Management](ranger-integration-config.html).
+
+
+## Configure Ranger for Kerberized HAWQ<a id="ra2hawq_kerb_cfg"></a>
+
+When you define HAWQ Ranger authorization policies, the Ranger Administration Host uses JDBC to connect to HAWQ during policy definition to look up policy resource names. When Kerberos user authentication is enabled for HAWQ, you must configure this connection for Kerberos.
+
+To configure Ranger access to a HAWQ cluster enabled with Kerberos user authentication, you must:
+
+- Identify an existing HAWQ administrative role or create a new HAWQ administrative role for Ranger lookup of HAWQ resources
+- Create a Kerberos principal for the lookup role
+- Update the Ranger HAWQ service definition
+
+### Procedure <a id="kerb_ra2hawq_proc"></a>
+
+Perform the following procedure to enable the Ranger Administration Host to look up resources in your kerberized HAWQ cluster. You will perform operations on the HAWQ \<master\>, \<ranger-admin-node\>, and \<kdc-server\> nodes.
+
+1. Log in to the HAWQ master node and set up your environment:
+
+ ``` shell
+ $ ssh gpadmin@<master>
+ gpadmin@master$ . /usr/local/hawq/greenplum_path.sh
+ ```
+
+2. Identify an existing or create a new HAWQ administrative role for Ranger resource lookup. For example, to create a new administrative role:
+
+ ``` shell
+ gpadmin@master$ psql -c 'CREATE ROLE "rangerlookup_hawq" with LOGIN SUPERUSER;'
+ ```
+
+ You may choose a different name for the Ranger lookup role.
+
+3. Log in to the KDC server system and generate a principal for the HAWQ `rangerlookup_hawq` role. Substitute your Kerberos \<realm\>. For example:
+
+ ``` shell
+ $ ssh root@<kdc-server>
+ root@kdc-server$ kadmin.local -q "addprinc -pw changeme rangerlookup_hawq@REALM.DOMAIN"
+ ```
+
+ You do not need to generate a keytab file for the `rangerlookup_hawq` principal because you will provide the password in the HAWQ service definition of the Ranger Admin UI.
+
+4. Start the Ranger Admin UI in a supported web browser. The default URL is \<ranger-admin-node\>:6080.
+
+5. Locate the HAWQ service definition and press the **Edit** button.
+
+6. Update the applicable **Config Properties** fields:
+
+ **HAWQ User Name*** - The HAWQ Ranger lookup role you identified or created in Step 2 above.
+ **HAWQ User Password*** - The password you assigned to the HAWQ Ranger lookup role principal.
+ **HAWQ Kerberos Service Name** - `postgres`
+
+7. Click the **Test Connection** button. If you connect successfully, Ranger displays a dialog with the message:
+
+ ``` pre
+ Connected Successfully.
+ ```
+
+ You successfully configured Ranger to use Kerberos authentication when looking up HAWQ resource names.
+
+8. **Save** your changes to permanently configure Kerberos authentication for HAWQ Ranger resource lookup.
+
+
+## Configure HAWQ for Kerberized Ranger<a id="rps2ra_kerb_cfg"></a>
+
+When Ranger Authorization is enabled for HAWQ, the Ranger Plug-in Service fetches policies from the Ranger Administration host. When Kerberos is enabled for Ranger, you must specifically configure the Ranger Plug-in Service for this communication.
+
+This procedure includes:
+
+- Adding an administrative Ranger user named `postgres`
+- Updating HAWQ Ranger Plug-in Service configuration to utilize Kerberos
+- Updating the HAWQ service definition in the Ranger Admin UI
+
+
+### Procedure <a id="kerb_rps2ra_proc"></a>
+
+Perform the following steps to enable Ranger Plug-in Service policy refresh from a kerberized Ranger:
+
+1. Create a `postgres` Ranger administrative user.
+
+ 1. Open the Ranger Admin UI. The default URL is \<ranger-admin-node\>:6080.
+ 2. Navigate to **Settings > Users/Groups**.
+ 3. Press the **Add New User** button.
+ 4. Fill out the required fields in the **User Detail** dialog:
+
+ **User Name*** - `postgres`
+ **New Password*** - The user's password ?? IS THIS SIGNIFICANT ??
--- End diff --

Need answer to ?? ?? here.

[GitHub] incubator-hawq-docs pull request #128: HAWQ-1479 - doc ranger kerberos integ...

Posted by dyozie <gi...@git.apache.org>.

Github user dyozie commented on a diff in the pull request:

https://github.com/apache/incubator-hawq-docs/pull/128#discussion_r127073559

--- Diff: markdown/ranger/ranger-kerberos.html.md.erb ---
@@ -0,0 +1,209 @@
+---
+title: HAWQ Ranger Kerberos Integration
+---
+
+
+
+When you have enabled Ranger Authorization for HAWQ, your HAWQ installation includes the Ranger Administrative UI and HAWQ Ranger Plug-in Service.
+
+Specific HAWQ Ranger configuration is required when Kerberos authentication is enabled for HAWQ or for Ranger. You must configure Kerberos support for:
+
+- HAWQ resource lookup by the Ranger Administration host during HAWQ policy definition
+- HAWQ Ranger Plug-in Service communication with the Ranger Administration host for policy refresh
+
+Use the following procedures to configure Kerberos support for your Ranger-authorized HAWQ cluster.
+
+## Prerequisites <a id="kerb_ranger_prereq"></a>
+
+Before you configure Kerberos for your Ranger-authorized HAWQ cluster, ensure that you have:
+
+- Installed Java 1.7.0\_17 or later on all nodes in your cluster. Java 1.7.0_17 is required to use Kerberos-authenticated JDBC on Red Hat Enterprise Linux 6.x or 7.x.
+- (Non-OpenJDK Java installations) Installed the Java Cryptography Extension (JCE) on all nodes in your cluster.
+ - If you manage your cluster with Ambari, you installed the JCE on each node before you enabled Kerberos with the Ambari **Kerberos Security Wizard**.
+ - If you manage your cluster from the command line, you must manually install the extension on these systems.
+- Noted the host name or IP address of your Ranger Administration host (\<ranger-admin-node\>) and HAWQ master (\<master\>) nodes.
+- Identified an existing Kerberos Key Distribution Center (KDC) or set up your KDC as described in [Install and Configure a Kerberos KDC Server](../clientaccess/kerberos.html#task_setup_kdc).
+ - Note the host name or IP address of your KDC (\<kdc-server\>).
+ - Note the name of the Kerberos \<realm\> in which your cluster resides.
+- Enabled Ranger Authorization for HAWQ. See [Configuring HAWQ to use Ranger Policy Management](ranger-integration-config.html).
+
+
+## Configure Ranger for Kerberized HAWQ<a id="ra2hawq_kerb_cfg"></a>
+
+When you define HAWQ Ranger authorization policies, the Ranger Administration Host uses JDBC to connect to HAWQ during policy definition to look up policy resource names. When Kerberos user authentication is enabled for HAWQ, you must configure this connection for Kerberos.
+
+To configure Ranger access to a HAWQ cluster enabled with Kerberos user authentication, you must:
+
+- Identify an existing HAWQ administrative role or create a new HAWQ administrative role for Ranger lookup of HAWQ resources
+- Create a Kerberos principal for the lookup role
+- Update the Ranger HAWQ service definition
+
+### Procedure <a id="kerb_ra2hawq_proc"></a>
+
+Perform the following procedure to enable the Ranger Administration Host to look up resources in your kerberized HAWQ cluster. You will perform operations on the HAWQ \<master\>, \<ranger-admin-node\>, and \<kdc-server\> nodes.
+
+1. Log in to the HAWQ master node and set up your environment:
+
+ ``` shell
+ $ ssh gpadmin@<master>
+ gpadmin@master$ . /usr/local/hawq/greenplum_path.sh
+ ```
+
+2. Identify an existing or create a new HAWQ administrative role for Ranger resource lookup. For example, to create a new administrative role:
+
+ ``` shell
+ gpadmin@master$ psql -c 'CREATE ROLE "rangerlookup_hawq" with LOGIN SUPERUSER;'
+ ```
+
+ You may choose a different name for the Ranger lookup role.
+
+3. Log in to the KDC server system and generate a principal for the HAWQ `rangerlookup_hawq` role. Substitute your Kerberos \<realm\>. For example:
+
+ ``` shell
+ $ ssh root@<kdc-server>
+ root@kdc-server$ kadmin.local -q "addprinc -pw changeme rangerlookup_hawq@REALM.DOMAIN"
+ ```
+
+ You do not need to generate a keytab file for the `rangerlookup_hawq` principal because you will provide the password in the HAWQ service definition of the Ranger Admin UI.
+
+4. Start the Ranger Admin UI in a supported web browser. The default URL is \<ranger-admin-node\>:6080.
+
+5. Locate the HAWQ service definition and press the **Edit** button.
+
+6. Update the applicable **Config Properties** fields:
+
+ **HAWQ User Name*** - The HAWQ Ranger lookup role you identified or created in Step 2 above.
+ **HAWQ User Password*** - The password you assigned to the HAWQ Ranger lookup role principal.
+ **HAWQ Kerberos Service Name** - `postgres`
+
+7. Click the **Test Connection** button. If you connect successfully, Ranger displays a dialog with the message:
+
+ ``` pre
+ Connected Successfully.
+ ```
+
+ You successfully configured Ranger to use Kerberos authentication when looking up HAWQ resource names.
+
+8. **Save** your changes to permanently configure Kerberos authentication for HAWQ Ranger resource lookup.
+
+
+## Configure HAWQ for Kerberized Ranger<a id="rps2ra_kerb_cfg"></a>
+
+When Ranger Authorization is enabled for HAWQ, the Ranger Plug-in Service fetches policies from the Ranger Administration host. When Kerberos is enabled for Ranger, you must specifically configure the Ranger Plug-in Service for this communication.
+
+This procedure includes:
+
+- Adding an administrative Ranger user named `postgres`
+- Updating HAWQ Ranger Plug-in Service configuration to utilize Kerberos
+- Updating the HAWQ service definition in the Ranger Admin UI
+
+
+### Procedure <a id="kerb_rps2ra_proc"></a>
+
+Perform the following steps to enable Ranger Plug-in Service policy refresh from a kerberized Ranger:
+
+1. Create a `postgres` Ranger administrative user.
+
+ 1. Open the Ranger Admin UI. The default URL is \<ranger-admin-node\>:6080.
+ 2. Navigate to **Settings > Users/Groups**.
+ 3. Press the **Add New User** button.
--- End diff --

Press -> Click

[GitHub] incubator-hawq-docs pull request #128: HAWQ-1479 - doc ranger kerberos integ...

Posted by interma <gi...@git.apache.org>.

Github user interma commented on a diff in the pull request:

https://github.com/apache/incubator-hawq-docs/pull/128#discussion_r127405360

Yes, all four of them are only used for ranger->kerberized hawq (step6~9 you had wroten in "Configure Ranger for Kerberized HAWQ" section)
You should remove them in the "Configure HAWQ for Kerberized Ranger" secion.

[GitHub] incubator-hawq-docs pull request #128: HAWQ-1479 - doc ranger kerberos integ...

Posted by dyozie <gi...@git.apache.org>.

Github user dyozie commented on a diff in the pull request:

https://github.com/apache/incubator-hawq-docs/pull/128#discussion_r127072711

Small edit: Identify an existing **HAWQ administrative role** or create a new ...

[GitHub] incubator-hawq-docs pull request #128: HAWQ-1479 - doc ranger kerberos integ...

Posted by dyozie <gi...@git.apache.org>.

Github user dyozie commented on a diff in the pull request:

https://github.com/apache/incubator-hawq-docs/pull/128#discussion_r127073872

I think for consistency we should change the hyphens to colons here. Also use sentences here: "Enter the HAWQ Ranger lookup role ..."

[GitHub] incubator-hawq-docs pull request #128: HAWQ-1479 - doc ranger kerberos integ...

Posted by dyozie <gi...@git.apache.org>.

Github user dyozie commented on a diff in the pull request:

https://github.com/apache/incubator-hawq-docs/pull/128#discussion_r127075938

--- Diff: markdown/ranger/ranger-kerberos.html.md.erb ---
@@ -0,0 +1,209 @@
+---
+title: HAWQ Ranger Kerberos Integration
+---
+
+
+
+When you have enabled Ranger Authorization for HAWQ, your HAWQ installation includes the Ranger Administrative UI and HAWQ Ranger Plug-in Service.
+
+Specific HAWQ Ranger configuration is required when Kerberos authentication is enabled for HAWQ or for Ranger. You must configure Kerberos support for:
+
+- HAWQ resource lookup by the Ranger Administration host during HAWQ policy definition
+- HAWQ Ranger Plug-in Service communication with the Ranger Administration host for policy refresh
+
+Use the following procedures to configure Kerberos support for your Ranger-authorized HAWQ cluster.
+
+## Prerequisites <a id="kerb_ranger_prereq"></a>
+
+Before you configure Kerberos for your Ranger-authorized HAWQ cluster, ensure that you have:
+
+- Installed Java 1.7.0\_17 or later on all nodes in your cluster. Java 1.7.0_17 is required to use Kerberos-authenticated JDBC on Red Hat Enterprise Linux 6.x or 7.x.
+- (Non-OpenJDK Java installations) Installed the Java Cryptography Extension (JCE) on all nodes in your cluster.
+ - If you manage your cluster with Ambari, you installed the JCE on each node before you enabled Kerberos with the Ambari **Kerberos Security Wizard**.
+ - If you manage your cluster from the command line, you must manually install the extension on these systems.
+- Noted the host name or IP address of your Ranger Administration host (\<ranger-admin-node\>) and HAWQ master (\<master\>) nodes.
+- Identified an existing Kerberos Key Distribution Center (KDC) or set up your KDC as described in [Install and Configure a Kerberos KDC Server](../clientaccess/kerberos.html#task_setup_kdc).
+ - Note the host name or IP address of your KDC (\<kdc-server\>).
+ - Note the name of the Kerberos \<realm\> in which your cluster resides.
+- Enabled Ranger Authorization for HAWQ. See [Configuring HAWQ to use Ranger Policy Management](ranger-integration-config.html).
+
+
+## Configure Ranger for Kerberized HAWQ<a id="ra2hawq_kerb_cfg"></a>
+
+When you define HAWQ Ranger authorization policies, the Ranger Administration Host uses JDBC to connect to HAWQ during policy definition to look up policy resource names. When Kerberos user authentication is enabled for HAWQ, you must configure this connection for Kerberos.
+
+To configure Ranger access to a HAWQ cluster enabled with Kerberos user authentication, you must:
+
+- Identify an existing HAWQ administrative role or create a new HAWQ administrative role for Ranger lookup of HAWQ resources
+- Create a Kerberos principal for the lookup role
+- Update the Ranger HAWQ service definition
+
+### Procedure <a id="kerb_ra2hawq_proc"></a>
+
+Perform the following procedure to enable the Ranger Administration Host to look up resources in your kerberized HAWQ cluster. You will perform operations on the HAWQ \<master\>, \<ranger-admin-node\>, and \<kdc-server\> nodes.
+
+1. Log in to the HAWQ master node and set up your environment:
+
+ ``` shell
+ $ ssh gpadmin@<master>
+ gpadmin@master$ . /usr/local/hawq/greenplum_path.sh
+ ```
+
+2. Identify an existing or create a new HAWQ administrative role for Ranger resource lookup. For example, to create a new administrative role:
+
+ ``` shell
+ gpadmin@master$ psql -c 'CREATE ROLE "rangerlookup_hawq" with LOGIN SUPERUSER;'
+ ```
+
+ You may choose a different name for the Ranger lookup role.
+
+3. Log in to the KDC server system and generate a principal for the HAWQ `rangerlookup_hawq` role. Substitute your Kerberos \<realm\>. For example:
+
+ ``` shell
+ $ ssh root@<kdc-server>
+ root@kdc-server$ kadmin.local -q "addprinc -pw changeme rangerlookup_hawq@REALM.DOMAIN"
+ ```
+
+ You do not need to generate a keytab file for the `rangerlookup_hawq` principal because you will provide the password in the HAWQ service definition of the Ranger Admin UI.
+
+4. Start the Ranger Admin UI in a supported web browser. The default URL is \<ranger-admin-node\>:6080.
+
+5. Locate the HAWQ service definition and press the **Edit** button.
+
+6. Update the applicable **Config Properties** fields:
+
+ **HAWQ User Name*** - The HAWQ Ranger lookup role you identified or created in Step 2 above.
+ **HAWQ User Password*** - The password you assigned to the HAWQ Ranger lookup role principal.
+ **HAWQ Kerberos Service Name** - `postgres`
+
+7. Click the **Test Connection** button. If you connect successfully, Ranger displays a dialog with the message:
+
+ ``` pre
+ Connected Successfully.
+ ```
+
+ You successfully configured Ranger to use Kerberos authentication when looking up HAWQ resource names.
+
+8. **Save** your changes to permanently configure Kerberos authentication for HAWQ Ranger resource lookup.
+
+
+## Configure HAWQ for Kerberized Ranger<a id="rps2ra_kerb_cfg"></a>
+
+When Ranger Authorization is enabled for HAWQ, the Ranger Plug-in Service fetches policies from the Ranger Administration host. When Kerberos is enabled for Ranger, you must specifically configure the Ranger Plug-in Service for this communication.
+
+This procedure includes:
+
+- Adding an administrative Ranger user named `postgres`
+- Updating HAWQ Ranger Plug-in Service configuration to utilize Kerberos
+- Updating the HAWQ service definition in the Ranger Admin UI
+
+
+### Procedure <a id="kerb_rps2ra_proc"></a>
+
+Perform the following steps to enable Ranger Plug-in Service policy refresh from a kerberized Ranger:
+
+1. Create a `postgres` Ranger administrative user.
+
+ 1. Open the Ranger Admin UI. The default URL is \<ranger-admin-node\>:6080.
+ 2. Navigate to **Settings > Users/Groups**.
+ 3. Press the **Add New User** button.
+ 4. Fill out the required fields in the **User Detail** dialog:
+
+ **User Name*** - `postgres`
+ **New Password*** - The user's password ?? IS THIS SIGNIFICANT ??
+ **Password Confirm*** - Enter the password again
+ **First Name*** - The first name of the user
+ **Select Role*** - Select the **Admin** role
+
+2. Update the HAWQ Ranger Plug-in Service configuration to use Kerberos authentication when communicating with Ranger.
+
+ 2. Edit the HAWQ Ranger Plug-in Service `rps.properties` configuration file and set the `RPS_AUTH` property to specify Kerberos authentication.
+
+ ``` shell
+ gpadmin@master$ vi $GPHOME/ranger/etc/rps.properties
+ ```
+
+ ``` pre
+ RPS_AUTH=kerberos
+ ```
+
+ 3. `rps.properties` also includes `RPS_PRINCIPAL` and `RPS_KEYTAB` properties. If unset, the Ranger Plug-in Service uses the Kerberos credentials cache in place for the HAWQ runtime user account (typically `gpadmin`). Set these properties if the default values are not appropriate for your environment.
--- End diff --

also includes **the**

If **these properties are** unset, the Ranger Plug-in Service uses the **cached Kerberos credentials that are available** for the HAWQ runtime user account (typically `gpadmin`). <--- I *think* this edit is correct.

[GitHub] incubator-hawq-docs pull request #128: HAWQ-1479 - doc ranger kerberos integ...

Posted by interma <gi...@git.apache.org>.

Github user interma commented on a diff in the pull request:

https://github.com/apache/incubator-hawq-docs/pull/128#discussion_r127154422

After this step, user should validate the "rangerlookup_hawq" account:
```
kinit rangerlookup_hawq
psql -d postgres -p 5432 -U rangerlookup_hawq -h hawq-host
# check whether connect hawq successfully
```

So if there are somethings wrong, user can detect it earlier.

[GitHub] incubator-hawq-docs pull request #128: HAWQ-1479 - doc ranger kerberos integ...

Posted by dyozie <gi...@git.apache.org>.

Github user dyozie commented on a diff in the pull request:

https://github.com/apache/incubator-hawq-docs/pull/128#discussion_r127073500

press -> click

[GitHub] incubator-hawq-docs pull request #128: HAWQ-1479 - doc ranger kerberos integ...

Posted by dyozie <gi...@git.apache.org>.

Github user dyozie commented on a diff in the pull request:

https://github.com/apache/incubator-hawq-docs/pull/128#discussion_r127073604

--- Diff: markdown/ranger/ranger-kerberos.html.md.erb ---
@@ -0,0 +1,209 @@
+---
+title: HAWQ Ranger Kerberos Integration
+---
+
+
+
+When you have enabled Ranger Authorization for HAWQ, your HAWQ installation includes the Ranger Administrative UI and HAWQ Ranger Plug-in Service.
+
+Specific HAWQ Ranger configuration is required when Kerberos authentication is enabled for HAWQ or for Ranger. You must configure Kerberos support for:
+
+- HAWQ resource lookup by the Ranger Administration host during HAWQ policy definition
+- HAWQ Ranger Plug-in Service communication with the Ranger Administration host for policy refresh
+
+Use the following procedures to configure Kerberos support for your Ranger-authorized HAWQ cluster.
+
+## Prerequisites <a id="kerb_ranger_prereq"></a>
+
+Before you configure Kerberos for your Ranger-authorized HAWQ cluster, ensure that you have:
+
+- Installed Java 1.7.0\_17 or later on all nodes in your cluster. Java 1.7.0_17 is required to use Kerberos-authenticated JDBC on Red Hat Enterprise Linux 6.x or 7.x.
+- (Non-OpenJDK Java installations) Installed the Java Cryptography Extension (JCE) on all nodes in your cluster.
+ - If you manage your cluster with Ambari, you installed the JCE on each node before you enabled Kerberos with the Ambari **Kerberos Security Wizard**.
+ - If you manage your cluster from the command line, you must manually install the extension on these systems.
+- Noted the host name or IP address of your Ranger Administration host (\<ranger-admin-node\>) and HAWQ master (\<master\>) nodes.
+- Identified an existing Kerberos Key Distribution Center (KDC) or set up your KDC as described in [Install and Configure a Kerberos KDC Server](../clientaccess/kerberos.html#task_setup_kdc).
+ - Note the host name or IP address of your KDC (\<kdc-server\>).
+ - Note the name of the Kerberos \<realm\> in which your cluster resides.
+- Enabled Ranger Authorization for HAWQ. See [Configuring HAWQ to use Ranger Policy Management](ranger-integration-config.html).
+
+
+## Configure Ranger for Kerberized HAWQ<a id="ra2hawq_kerb_cfg"></a>
+
+When you define HAWQ Ranger authorization policies, the Ranger Administration Host uses JDBC to connect to HAWQ during policy definition to look up policy resource names. When Kerberos user authentication is enabled for HAWQ, you must configure this connection for Kerberos.
+
+To configure Ranger access to a HAWQ cluster enabled with Kerberos user authentication, you must:
+
+- Identify an existing HAWQ administrative role or create a new HAWQ administrative role for Ranger lookup of HAWQ resources
+- Create a Kerberos principal for the lookup role
+- Update the Ranger HAWQ service definition
+
+### Procedure <a id="kerb_ra2hawq_proc"></a>
+
+Perform the following procedure to enable the Ranger Administration Host to look up resources in your kerberized HAWQ cluster. You will perform operations on the HAWQ \<master\>, \<ranger-admin-node\>, and \<kdc-server\> nodes.
+
+1. Log in to the HAWQ master node and set up your environment:
+
+ ``` shell
+ $ ssh gpadmin@<master>
+ gpadmin@master$ . /usr/local/hawq/greenplum_path.sh
+ ```
+
+2. Identify an existing or create a new HAWQ administrative role for Ranger resource lookup. For example, to create a new administrative role:
+
+ ``` shell
+ gpadmin@master$ psql -c 'CREATE ROLE "rangerlookup_hawq" with LOGIN SUPERUSER;'
+ ```
+
+ You may choose a different name for the Ranger lookup role.
+
+3. Log in to the KDC server system and generate a principal for the HAWQ `rangerlookup_hawq` role. Substitute your Kerberos \<realm\>. For example:
+
+ ``` shell
+ $ ssh root@<kdc-server>
+ root@kdc-server$ kadmin.local -q "addprinc -pw changeme rangerlookup_hawq@REALM.DOMAIN"
+ ```
+
+ You do not need to generate a keytab file for the `rangerlookup_hawq` principal because you will provide the password in the HAWQ service definition of the Ranger Admin UI.
+
+4. Start the Ranger Admin UI in a supported web browser. The default URL is \<ranger-admin-node\>:6080.
+
+5. Locate the HAWQ service definition and press the **Edit** button.
+
+6. Update the applicable **Config Properties** fields:
+
+ **HAWQ User Name*** - The HAWQ Ranger lookup role you identified or created in Step 2 above.
+ **HAWQ User Password*** - The password you assigned to the HAWQ Ranger lookup role principal.
+ **HAWQ Kerberos Service Name** - `postgres`
+
+7. Click the **Test Connection** button. If you connect successfully, Ranger displays a dialog with the message:
+
+ ``` pre
+ Connected Successfully.
+ ```
+
+ You successfully configured Ranger to use Kerberos authentication when looking up HAWQ resource names.
+
+8. **Save** your changes to permanently configure Kerberos authentication for HAWQ Ranger resource lookup.
+
+
+## Configure HAWQ for Kerberized Ranger<a id="rps2ra_kerb_cfg"></a>
+
+When Ranger Authorization is enabled for HAWQ, the Ranger Plug-in Service fetches policies from the Ranger Administration host. When Kerberos is enabled for Ranger, you must specifically configure the Ranger Plug-in Service for this communication.
+
+This procedure includes:
+
+- Adding an administrative Ranger user named `postgres`
+- Updating HAWQ Ranger Plug-in Service configuration to utilize Kerberos
+- Updating the HAWQ service definition in the Ranger Admin UI
+
+
+### Procedure <a id="kerb_rps2ra_proc"></a>
+
+Perform the following steps to enable Ranger Plug-in Service policy refresh from a kerberized Ranger:
+
+1. Create a `postgres` Ranger administrative user.
+
+ 1. Open the Ranger Admin UI. The default URL is \<ranger-admin-node\>:6080.
+ 2. Navigate to **Settings > Users/Groups**.
+ 3. Press the **Add New User** button.
+ 4. Fill out the required fields in the **User Detail** dialog:
+
+ **User Name*** - `postgres`
+ **New Password*** - The user's password ?? IS THIS SIGNIFICANT ??
+ **Password Confirm*** - Enter the password again
+ **First Name*** - The first name of the user
+ **Select Role*** - Select the **Admin** role
+
+2. Update the HAWQ Ranger Plug-in Service configuration to use Kerberos authentication when communicating with Ranger.
+
+ 2. Edit the HAWQ Ranger Plug-in Service `rps.properties` configuration file and set the `RPS_AUTH` property to specify Kerberos authentication.
+
+ ``` shell
+ gpadmin@master$ vi $GPHOME/ranger/etc/rps.properties
+ ```
+
+ ``` pre
+ RPS_AUTH=kerberos
+ ```
+
+ 3. `rps.properties` also includes `RPS_PRINCIPAL` and `RPS_KEYTAB` properties. If unset, the Ranger Plug-in Service uses the Kerberos credentials cache in place for the HAWQ runtime user account (typically `gpadmin`). Set these properties if the default values are not appropriate for your environment.
+
+3. Stop the Ranger Plug-in Service:
+
+ ``` shell
+ gpadmin@master$ $GPHOME/ranger/bin/rps.sh stop
+ ```
+
+4. Generate a ticket for the `postgres@<realm>` principal:
+
+ ``` shell
+ gpadmin@master$ kinit -kt /etc/security/keytabs/hawq.service.keytab postgres@REALM.DOMAIN
+ ```
+
+5. Restart the HAWQ Ranger Plug-in Service:
+
+ ``` shell
+ gpadmin@master$ $GPHOME/ranger/bin/rps.sh start
+ ```
+
+6. If you have enabled HAWQ Ranger High Availability, synchronize the HAWQ Ranger Plug-in Service configuration files from the HAWQ master node to the standby master node as described in the [Register a Standby Ranger Plug-in Service](ranger-integration-config.html#rps_ha_cfg_standbyrps) procedure, including restarting the standby master node.
+
+7. Navigate to the Ranger Admin UI in a supported web browser. The default URL is \<ranger-admin-node\>:6080.
+
+8. Locate the **HAWQ** service definition and press the **Edit** button.
--- End diff --

press -> click

[GitHub] incubator-hawq-docs pull request #128: HAWQ-1479 - doc ranger kerberos integ...

Posted by dyozie <gi...@git.apache.org>.

Github user dyozie commented on a diff in the pull request:

https://github.com/apache/incubator-hawq-docs/pull/128#discussion_r127075036

--- Diff: markdown/ranger/ranger-kerberos.html.md.erb ---
@@ -0,0 +1,209 @@
+---
+title: HAWQ Ranger Kerberos Integration
+---
+
+
+
+When you have enabled Ranger Authorization for HAWQ, your HAWQ installation includes the Ranger Administrative UI and HAWQ Ranger Plug-in Service.
+
+Specific HAWQ Ranger configuration is required when Kerberos authentication is enabled for HAWQ or for Ranger. You must configure Kerberos support for:
+
+- HAWQ resource lookup by the Ranger Administration host during HAWQ policy definition
+- HAWQ Ranger Plug-in Service communication with the Ranger Administration host for policy refresh
+
+Use the following procedures to configure Kerberos support for your Ranger-authorized HAWQ cluster.
+
+## Prerequisites <a id="kerb_ranger_prereq"></a>
+
+Before you configure Kerberos for your Ranger-authorized HAWQ cluster, ensure that you have:
+
+- Installed Java 1.7.0\_17 or later on all nodes in your cluster. Java 1.7.0_17 is required to use Kerberos-authenticated JDBC on Red Hat Enterprise Linux 6.x or 7.x.
+- (Non-OpenJDK Java installations) Installed the Java Cryptography Extension (JCE) on all nodes in your cluster.
+ - If you manage your cluster with Ambari, you installed the JCE on each node before you enabled Kerberos with the Ambari **Kerberos Security Wizard**.
+ - If you manage your cluster from the command line, you must manually install the extension on these systems.
+- Noted the host name or IP address of your Ranger Administration host (\<ranger-admin-node\>) and HAWQ master (\<master\>) nodes.
+- Identified an existing Kerberos Key Distribution Center (KDC) or set up your KDC as described in [Install and Configure a Kerberos KDC Server](../clientaccess/kerberos.html#task_setup_kdc).
+ - Note the host name or IP address of your KDC (\<kdc-server\>).
+ - Note the name of the Kerberos \<realm\> in which your cluster resides.
+- Enabled Ranger Authorization for HAWQ. See [Configuring HAWQ to use Ranger Policy Management](ranger-integration-config.html).
+
+
+## Configure Ranger for Kerberized HAWQ<a id="ra2hawq_kerb_cfg"></a>
+
+When you define HAWQ Ranger authorization policies, the Ranger Administration Host uses JDBC to connect to HAWQ during policy definition to look up policy resource names. When Kerberos user authentication is enabled for HAWQ, you must configure this connection for Kerberos.
+
+To configure Ranger access to a HAWQ cluster enabled with Kerberos user authentication, you must:
+
+- Identify an existing HAWQ administrative role or create a new HAWQ administrative role for Ranger lookup of HAWQ resources
+- Create a Kerberos principal for the lookup role
+- Update the Ranger HAWQ service definition
+
+### Procedure <a id="kerb_ra2hawq_proc"></a>
+
+Perform the following procedure to enable the Ranger Administration Host to look up resources in your kerberized HAWQ cluster. You will perform operations on the HAWQ \<master\>, \<ranger-admin-node\>, and \<kdc-server\> nodes.
+
+1. Log in to the HAWQ master node and set up your environment:
+
+ ``` shell
+ $ ssh gpadmin@<master>
+ gpadmin@master$ . /usr/local/hawq/greenplum_path.sh
+ ```
+
+2. Identify an existing or create a new HAWQ administrative role for Ranger resource lookup. For example, to create a new administrative role:
+
+ ``` shell
+ gpadmin@master$ psql -c 'CREATE ROLE "rangerlookup_hawq" with LOGIN SUPERUSER;'
+ ```
+
+ You may choose a different name for the Ranger lookup role.
+
+3. Log in to the KDC server system and generate a principal for the HAWQ `rangerlookup_hawq` role. Substitute your Kerberos \<realm\>. For example:
+
+ ``` shell
+ $ ssh root@<kdc-server>
+ root@kdc-server$ kadmin.local -q "addprinc -pw changeme rangerlookup_hawq@REALM.DOMAIN"
+ ```
+
+ You do not need to generate a keytab file for the `rangerlookup_hawq` principal because you will provide the password in the HAWQ service definition of the Ranger Admin UI.
+
+4. Start the Ranger Admin UI in a supported web browser. The default URL is \<ranger-admin-node\>:6080.
+
+5. Locate the HAWQ service definition and press the **Edit** button.
+
+6. Update the applicable **Config Properties** fields:
+
+ **HAWQ User Name*** - The HAWQ Ranger lookup role you identified or created in Step 2 above.
+ **HAWQ User Password*** - The password you assigned to the HAWQ Ranger lookup role principal.
+ **HAWQ Kerberos Service Name** - `postgres`
+
+7. Click the **Test Connection** button. If you connect successfully, Ranger displays a dialog with the message:
+
+ ``` pre
+ Connected Successfully.
+ ```
+
+ You successfully configured Ranger to use Kerberos authentication when looking up HAWQ resource names.
+
+8. **Save** your changes to permanently configure Kerberos authentication for HAWQ Ranger resource lookup.
+
+
+## Configure HAWQ for Kerberized Ranger<a id="rps2ra_kerb_cfg"></a>
+
+When Ranger Authorization is enabled for HAWQ, the Ranger Plug-in Service fetches policies from the Ranger Administration host. When Kerberos is enabled for Ranger, you must specifically configure the Ranger Plug-in Service for this communication.
+
+This procedure includes:
+
+- Adding an administrative Ranger user named `postgres`
+- Updating HAWQ Ranger Plug-in Service configuration to utilize Kerberos
+- Updating the HAWQ service definition in the Ranger Admin UI
+
+
+### Procedure <a id="kerb_rps2ra_proc"></a>
+
+Perform the following steps to enable Ranger Plug-in Service policy refresh from a kerberized Ranger:
+
+1. Create a `postgres` Ranger administrative user.
+
+ 1. Open the Ranger Admin UI. The default URL is \<ranger-admin-node\>:6080.
+ 2. Navigate to **Settings > Users/Groups**.
+ 3. Press the **Add New User** button.
+ 4. Fill out the required fields in the **User Detail** dialog:
+
+ **User Name*** - `postgres`
--- End diff --

Same edit as above list.

[GitHub] incubator-hawq-docs pull request #128: HAWQ-1479 - doc ranger kerberos integ...

Posted by asfgit <gi...@git.apache.org>.

Github user asfgit closed the pull request at:

    https://github.com/apache/incubator-hawq-docs/pull/128


---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---

[GitHub] incubator-hawq-docs pull request #128: HAWQ-1479 - doc ranger kerberos integ...

Posted by lisakowen <gi...@git.apache.org>.

Github user lisakowen commented on a diff in the pull request:

https://github.com/apache/incubator-hawq-docs/pull/128#discussion_r127225477

thanks for reviewing, @interma!

i had thought that:
- username and password were used when configuring ranger->kerberized hawq
- authentication type and service name were used when configuring RPS->kerberized ranger

if all four of them are only used for ranger->kerberized hawq, i will update the appropriate sections.