Hi Jessie
By default, if the cluster/component is Kerberos enabled, then the call to get the Ranger polices from Ranger Admin will use Kerberos authentication. But my understanding is that if Ranger Admin is not in Kerberos-ed environment but only Ranger plugin is (plugin is on a Kerberos-ed Hadoop cluster where HDFS namenode is), then we don't need to add ranger as unix user or create principle/ keytab for it. When Ranger plugin is making the call using Kerberos, then Ranger Admin needs to authenticate the request and for that you need to provide appropriate keytab to Ranger Admin. Which means, you will need a keytab, which very well could be rangeradmin keytab. But since Ranger is not running any YARN jobs, you don’t need to materialize the ranger user on all the nodes. Similarly, the lookup user is used to get the list of folders/files/tables while adding policies, it will also need a keytab, but you could use the same Ranger Keytab (even though it is not recommended). Ranger Admin is not in Kerberos-ed environment Kerberos environment seems intimating, but it just running the process with the JAAS file as -D parameter or set the properties in the application. JAAS contains the Keytab and Principal. Or some applications take the keytab file location and principal from properties file (e.g. by Ranger). In Hadoop, the auth_to_local rule helps in mapping the Kerberos principal to unix friendly name. In short, if you already have Kerberos environment and you have KDC, then it is better to just create the keytabs for Ranger. It will be more secure and also very transparent in your deployment. Bosco From: Jessie Kao <gaojingxu....@gmail.com> Reply-To: <user@ranger.apache.org> Date: Wednesday, January 9, 2019 at 2:12 PM To: <user@ranger.apache.org> Subject: Question on necessity of adding "ranger" as kerberos principle and unix user in Kerberos-ed Hadoop cluster Hi, I have a Kerberos-ed Hadoop cluster that has Ranger HDFS plugin enabled and Ranger Admin is working fine with it. My question is: do I need to add "ranger" as kerberos principle and unix user in this Kerberos-ed Hadoop cluster or anywhere else? Would appreciate it if there are any recommended readings on the mechanism/ architecture diagram how Ranger admin <> Ranger plugin <> Hadoop (HDFS specifically) <> KDC works with each other. My current understanding is that we don't need to... The only place I saw ranger-admin principle is in the below doc for scenario when we want to install Ranger in Kerberos-ed environment. https://cwiki.apache.org/confluence/display/RANGER/Ranger+installation+in+Kerberized++Environment#RangerinstallationinKerberizedEnvironment-Summary But my understanding is that if Ranger Admin is not in Kerberos-ed environment but only Ranger plugin is (plugin is on a Kerberos-ed Hadoop cluster where HDFS namenode is), then we don't need to add ranger as unix user or create principle/ keytab for it. Would appreciate any advice on the question. Thanks, Jessie
