Enabling Ranger Authentication for Cluster Components

Scenarios

The Ranger component uses policy-based access control (PBAC) to manage permissions and implement fine-grained data access control on components such as HDFS, Hive, and HBase.

A component within an MRS cluster supports only one access control mechanism. After a Ranger permission control policy is enabled for a component, the permission on the component in the role created on MRS Manager becomes invalid (ACL rules of HDFS and YARN still take effect). You need to add a policy on the Ranger management page to grant permissions to resources.

By default, Ranger authentication is enabled for components in an MRS cluster that has Kerberos authentication enabled. Conversely, Ranger authentication is disabled for components in a cluster with Kerberos authentication disabled.

Cluster administrators can manually enable or disable Ranger authentication for specific components.

Notes and Constraints

• In a cluster in security mode (with Kerberos authentication enabled), the following components support Ranger authentication: CDL, HDFS, YARN, HBase, Hive, Spark/Spark2x, Kafka, and HetuEngine.
• In a cluster in normal mode (with Kerberos authentication disabled), the following components support Ranger authentication: HDFS, YARN, HBase, Hive, Spark/Spark2x, and HetuEngine.

Procedure

1. Log in to MRS Manager. For details, see Accessing FusionInsight Manager. Choose Cluster > Services > Name of the service for which Ranger authentication needs to be enabled.
2. In the upper right corner of the Dashboard page, click More and select Enable Ranger. In the displayed dialog box, enter the password and click OK. After the operation is successful, click Finish.
   

   • If Enable Ranger is dimmed (unavailable) as shown in Figure 1, Ranger authentication is enabled for the component.
   • For components (except HDFS and YARN) for which Ranger authorization has been enabled, the permissions of non-default roles on Manager do not take effect. You need to configure Ranger policies to assign permissions to user groups.
   Figure 1 Enabling Ranger Authentication
   

3. After the Ranger authentication configuration is modified, the configuration status of the component will display as expired. On the Dashboard page, you must restart or perform a rolling restart of the component for the configuration to take effect.
4. If the HetuEngine component is installed, you must restart the HetuEngine compute instances after a service restart.

Helpful Links

• After Ranger authentication is enabled for a component, the cluster administrator can access the Ranger web UI to configure resource permission policies. For details, see Logging In to the Ranger Web UI.
• For more information about MRS cluster user authentication policies, see MRS Cluster User Permission Authentication Policy.
• For specific Ranger permission configuration examples for each component, see Configuration Examples for Ranger Permission Policy.