Adding a Ranger Access Permission Policy for Storm

Updated on 2024-10-08 GMT+08:00

View PDF

Scenario

Ranger administrators can use Ranger to set permissions for Storm users.

Prerequisites

The Ranger service has been installed and is running properly.
You have created users, user groups, or roles for which you want to configure permissions.
The Ranger authentication function has been enabled on the page. The option in the following figure controls whether to enable the Ranger plug-in for permission control. If the function is enabled, the Ranger authentication is used. Otherwise, the authentication mechanism of the component is used.
Figure 1 Enabling Ranger authentication

Procedure

Log in to the Ranger web UI as the Ranger administrator rangeradmin. For details, see Logging In to the Ranger Web UI.
On the homepage, click Storm in the STORM area.
Click Add New Policy to add a Storm permission control policy.

Configure the parameters listed in the table below based on the service demands.

**Table 1** Storm permission parameters
Parameter	Description
Policy Conditions	IP address filtering policy, which can be customized. You can enter one or more IP addresses or IP address segments. The IP address can contain the wildcard character (), for example, 192.168.1.10,192.168.1.20, or 192.168.1..
Policy Name	Policy name, which can be customized and must be unique in the service. The include policy applies to the current input object, and the exclude policy applies to objects other than the current input object.
Policy Label	A label specified for the current policy. You can search for reports and filter policies based on labels.
Storm Topology	Name of the topology to which the current policy applies. One or more values can be entered.
Description	Policy description.
Audit Logging	Whether to audit the policy.
Allow Conditions	Policy allowed condition. You can configure permissions and exceptions allowed by the policy. In the Select Role, Select Group, and Select User columns, select the role, user group, or user to which the permission is to be granted, click Add Conditions, add the IP address range to which the policy applies, and click Add Permissions to add the corresponding permissions. Submit Topology: Submit a topology. NOTE: The Submit Topology permission takes effect only when Storm Topology is set to . File Upload: Upload a file. File Download: Download a file. Kill Topology: Delete a topology. Rebalance: Perform the rebalance operation. Activate: Activate the topology permission. Deactivate: Deactivate the topology permission. Get Topology Conf: Obtain topology configurations. Get Topology: Obtain a topology. Get User Topology: Obtain user's topology. Get Topology Info: Obtain topology information. Upload New Credential: Upload a new credential. Select/Deselect All: Select or deselect all. To add multiple permission control rules, click . If users or user groups in the current condition need to manage this policy, select Delegate Admin*. These users will become the agent administrators. The agent administrators can update and delete this policy and create sub-policies based on the original policy.
Deny Conditions	Policy rejection condition, which is used to configure the permissions and exceptions to be denied in the policy. The configuration method is similar to that of Allow Conditions.

(Optional) Add the validity period of the policy. Click Add Validity period in the upper right corner of the page, set Start Time and End Time, and select Time Zone. Click Save. To add multiple policy validity periods, click . To delete a policy validity period, click .
Click Add to view the basic information about the policy in the policy list. After the policy takes effect, check whether the related permissions are normal.

To disable a policy, click to edit the policy and set the policy to Disabled.

If a policy is no longer used, click to delete it.

Parent topic: Configuration Examples for Ranger Permission Policy

Previous topic: Adding a Ranger Access Permission Policy for Kafka

Next topic: Viewing Ranger Audit Information

Feedback

Was this page helpful?

Helpful Not helpful

Provide feedback

Thank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.

The system is busy. Please try again later.

Which of the following issues have you encountered?

Content is inconsistent with the product UI

Unclear descriptions

Lack of examples or code

Incorrect steps

Can't find what I need

Lack of best practices

Feedback (optional)

0/500

Select at least one type of issue, and enter your comments or suggestions.

Enter a maximum of 500 characters.

Submit Cancel

For any further questions, feel free to contact us through the chatbot.

Chatbot