...

Getting started 

General Features

 Login  Login to the system:

• You can Login to the system by providing your username and password. For simplicity, your username is also displayed on your home page. Be aware that the website login is case sensitive.You must use capital letters,numbers where appropriate in your username and password.

Log out to the system:

• Your username is also displayed on your homepage, on top right. Option to Logout is provided under the drop list here.

Service Manager (Access Manager)

...

• The Access Manager is accessible from the top page. The top page shows a list of tools supported by Ranger’s solution. The Access Manager adds and administers the services.
  
  

• Delegated Admin 

...

You can enable and disable the policy.By default the policy is in enabled state.After disabling the policy the user (except admin and admin user)won't have rights to access the policy anymore.

Add Service

• You can add a service by clicking on the plus icon next to each column on the Service Manager page. Details of the service and other config properties can be added in this step. The added service will be listed as show below.

...

• You can delete a service by clicking on the delete button next to each service name listed on the Manage service page.  

Ranger Policies

HDFS

• Adding HDFS policies

You can add a new policy from the HDFS policy listing page for a particular service. On add , the policy should be listed in the table below. You can search a Policy by search filters provided.

...

• Permissions while creating policy
  

...

Step 3 : Policy is created with unique id

...

• UDF :-

...

Syntax: grant <permissions> on table <table> to user <user or group>;    
 
i.e   : grant select on table default.newtable to user mark;

...

• • Similarly we can write it for (Update,Create,Drop,Alter,Index,Lock,All,Admin)

HBASE

...

•  Adding HBASE Policies

You can add a new policy from the HBASE Policy Listing Page. On add , the policy should be listed in the table below. You can search a Policy by ‘column’,’column family’,’Group name’,’Policy name’,’Status,Table,’’Username’.

Step 1 : Click on the Add New Policy button on listing page.

Image Modified

Step 2 : Add Hbase Policy

Image Modified

 

 

Label	Description
Policy  Name	Enter an appropriate policy name. This name is cannot be duplicated across the system.This field is mandatory.
Hbase Table	Select the appropriate database. Multiple tables can be selected for a particular policy. This field is mandatory
Hbase column-family	For the selected table, select column families for the which the policy will be applicable
Hbase column	For the selected table and CF, select columns for the which the policy will be applicable
Audit Logging	Choose whether the particular policy will be audited or not.
Group permission	From a user group list, pick a particular group and choose permissions for that group. Choosing admin permission will designate the group as admin for chosen resource
User Permission	From a user list, pick a particular group and choose permissions for that group. Choosing admin permission will designate the user as admin for the chosen resource
Enable/Disable	By default the policy is enabled.You can disable a policy to restrict user/group access for that policy.

Note
Wildcards: Wildcards can be included in resource path.’*’ indicates zero or more occurs of characters.’?‘ indicates single character.You can use wildcards in the table name ,column name ,column families.for e.g table name as *, column family as ? and column name as ?.

...

 

 

Permission	Description
Read	Allows user to perform  a read operation
Write	Allows user to perform  a write operation
Create	Allows user to perform  a create operation
Admin	This gives the delegated admin access to user

Note
GRANT:  HBase GRANT is a command used to provide access or privileges on Hbase database tables to the users.

Code Block
Syntax: grant '<user-or-group>','<permissions>','<table>'   i.e : grant 'mark’' , 'RW' , 'testtable2'

Note
This will create a policy and give read and write access to user1 on testtable2 .Similarly we can grant create and admin writes

 

Image Modified

Image Modified

 

 Edit / Delete HBASE Policies

• You can edit/delete a policy from the HBASE Policy Listing page by clicking on the edit/delete button next to policy row.

Image Modified

Syntax: revoke ‘<user-or-group>','<table>'
 
i.e   : revoke 'mark','testtable2'

Image Modified

Image Modified

KNOX

...

•  Adding KNOX Policies

You can add a new policy from the KNOX Policy Listing Page. On add , the policy should be listed in the table below. You can search a Policy by ‘Policy Name’,‘Topology Name’ , ‘Service Name’ and ‘Groups’.

Step 1 : Click on the Add New Policy button on listing page

Image Modified

Step 2 : Add knox policy

Image Modified

• Topology name: A topology is a graph of computation. Each node in a topology contains processing logic, and links between nodes indicate how data should be passed around between nodes.

• Service Name: Binds a Hadoop service with an internal URL that the gateway uses to proxy requests from external clients to the internal cluster services.

...

 

Label	Description
Policy name	Enter an appropriate policy name. This name is cannot be duplicated across the system.
Knox topology	Enter an appropriate Topology Name
Knox service	Enter an appropriate Service Name
Audit Logging	Choose whether the particular policy will be audited or not.
User permissions	From a user list, pick a particular group and choose permissions for that group. Choosing admin permission will designate the user as admin for the chosen resource
Group permissions	From a user group list, pick a particular group and choose permissions for that group. Choosing admin permission will designate the group as admin for chosen resource
Enable/disable	By default the policy is enabled.You can disable a policy to restrict user/group access for that policy.
Include/Exclude	The include flag means it will consider the values entered in the field.The default value is set as include.The exclude Flag will exclude all the table names or column names entered in that particular field.

Note
Wildcards: Wildcards can be included in resource path.’*’ indicates zero or more occurs of characters.’?‘ indicates single character.You can use wildcards in the topology name,service name.for e.g topology name as *, service name as ?.

 

 

Permission	Description
IP Address Range	Specify ip address range
Allow	Allow permission allows users to access topology that is specified in topology name

 

 

Edit/Delete Knox policies

...

• You can edit/delete a policy from the KNOX Policy Listing page by clicking on the edit/delete button next to policy row.

Image Modified

 

STORM

Adding STORM Policies

You can add a new policy from the STORM Policy Listing Page. On add , the policy should be listed in the table below. You can search a Policy by ‘Policy Name’,‘Topology Name’ and ‘Groups’.

Step 1 : Click on the Add New Policy button on listing page

Image Modified

Step 2 : Add STORM Policy

Image Modified

Edit/Delete STORM POlicies

...

• You can edit/delete a policy from the STORM Policy Listing page by clicking on the edit/delete button next to policy row.

YARN

...

• Adding Yarn policies

You can add a new policy from the YARN Policy Listing Page. On add , the policy should be listed in the table below. You can search a Policy by ‘Group name’,’Policy name’,’queue’,’Status’,’username’.

 Step 1 : Click on the Add New Policy button on listing page

Image Modified

Step 2 : Add YARN Policy

Image Modified

 

 

Label	Description
Policy Name	Enter an appropriate policy name. This name is cannot be duplicated across the system.
Queue	The fundamental unit of scheduling in yarn
Audit Logging	Choose whether the particular policy will be audited or not.
Enable/disable	By default the policy is enabled.You can disable a policy to restrict user/group access for that policy.
Recursive	You can indicate whether all files or folders within the existing folder comes under the policy.Can be used instead of wildcard characters
User Permission	From a user list, pick a particular group and choose permissions for that group. Choosing admin permission will designate the user as admin for the chosen resource
Group Permission	From a user group list, pick a particular group and choose permissions for that group. Choosing admin permission will designate the group as admin for chosen resource

Note
Wildcards: Wildcards can be included in resource path.’*’ indicates zero or more occurs of characters.’?‘ indicates single character.You can use wildcards in the topology name.for e.g topology name as ?.

 

 

 

Permission	Description
Submit-job	Allows user to submit a job on a defined queue
Admin-queue	Allows user to manage admin queue

Edit/Delete YARN policies

...

• You can edit/delete a policy from the YARN Policy Listing page by clicking on the edit/delete button next to policy row.

Image Modified

 

SOLR

...

•  Adding SOLR Policies

You can add a new policy from the STORM Policy Listing Page. On add , the policy should be listed in the table below. You can search a Policy by Collection,Group name,Policy name,status,user name.

Step 1 : Click on the Add New Policy button on listing page

Image Modified

Step 2 : Add SOLR policy

Image Modified

 

 

Label	Description
Policy Name	Enter an appropriate policy name. This name is cannot be duplicated across the system
Solr connection	http:<host_ip>:6083/solr
Audit logging	Choose whether the particular policy will be audited or not.
Group permission	From a user group list, pick a particular group and choose permissions for that group. Choosing admin permission will designate the group as admin for chosen resource
User Permission	From a user list, pick a particular group and choose permissions for that group. Choosing admin permission will designate the user as admin for the chosen resource
Enabled/disabled	By default the policy is enabled.You can disable a policy to restrict user/group access for that policy.
Include/Exclude	The include flag means it will consider the values entered in the field.The default value is set as include.The exclude Flag will exclude all the table names or column names entered in that particular field.

 

 

Permission	Description
Querry	Permission to fetch records from Solr DB.
Update	Permission to update records in Solr
Others
Solr Admin	Permission to manage user accounts and

Edit / Delete SOLR Policies

...

• You can edit/delete a policy from the SOLR Policy Listing page by clicking on the edit/delete button next to policy row.

Image Modified

 

KAFKA

Adding KAFKA Policies

• You can add a new policy from the KAFKA Policy Listing Page. On add , the policy should be listed in the table below. You can search a Policy by ‘Group name’,’Policy name’,Status,topic,’username’.

Step 1 : Click on the Add New Policy button on listing page

Image Modified

Step 2 : Add KAFKA Policy

Image Modified

...

• Policy permissions are assigned to users and groups.
 
•  

Users

...

• These are users who can login into the Ranger portal and perform administrative and reporting tasks.Roles can be assigned while adding the users.Only admins are allowed to create users and create services. The role of the ‘admin’/’admin user’ dictates what roles can be assigned to the new users.

 

• Internal Vs External Users

   

  • • Internal users are those users which are created by ranger Admin i.e XA Policy Manager .External users are those users which are synced from other system like Active Directory(AD) ,LDAP or unix system.

  ...

  Add Users

  ...

  • You can add a new group from the User Listing Page. On add , the user should be listed in the table below. The users that are created in the system are You can search a User by ‘Email Address’ ,‘Role’ ,‘User Name’,‘ User Source’,’user status’,’visibility’.

  
  

  Step 1 : Click on the Add New User button on the user listing page

  Image Modified

  Step 2 : Enter the details and save.

  Image Modified

   

   

  Label	Description
  User Name	Enter an appropriate user name. This name  cannot be duplicated across the system.
  New Password	Enter an appropriate password.
  Password Confirm	Confirm the entered password
  First Name	Enter an appropriate first name.
  Last Name	Enter an appropriate last name
  Email address	Enter an appropriate first email address in the required format
  Select Role	Enter an appropriate Role.
  Group	Select a role from the given roles ‘Admin’ , ‘Users’.This is a mandatory field

   

  Step 3 : Set visibility (i.e. Visible/Hidden)
  

  • After clicking on hidden button user get hide from policy listing page. For hiding functionality user must need to select check box located near User Name column.

  Image Modified

  
  Image Modified

  
  Image Modified

  Step 4 : Set visibility (Visible)

  • • After clicking on Visible option selected user get visible in users listing page.

  Image Modified

  Step 5 : Set status of the user.

  • If the status of the user is enable then that user can login to the application.If user status is disable then that particular user is not able to login to the application.

  Image Modified

  
  Image Modified

  ...

  Edit Users

   

  • We can edit only internal users.For the external users,only the role can be changed.

   Admin Login:     

  • You can edit a user from the users Listing page by clicking on the user name.

  Image Modified

  User Login:

  • You can edit a user from the users Listing page by clicking on profile.

  Image Modified

   

  Groups

  ...

  • Ranger allows assigning permissions at group level too.

   

  Add Groups

  ...

  • You can add a new group from the group Listing Page. On add , the group should be listed in the table below. You can search a group by ‘Group Name’ and ‘ Group Source’,visibility

  Step 1: Click on the Add New Group button on the group listing page.

  Image Modified

  Step 2 : Enter the details and save.

  Image Modified

   

   

  Label	Description
  Group Name	Enter an appropriate user name. This name  cannot be duplicated across the system.This is a mandatory field.
  Description	Give any description for reference.

  ...

   

  4.2.2 Edit Groups

  ...

  • You can edit a group from the groups Listing page by clicking on the name of the group.(Can only be performed by an admin)

  Image Modified

  • Visibility of Groups
  • Hidden group does not appears in group listing page.To make the group hide select the check box near group group name.

  Image Modified

  
  

  Image Modified

   

  Reports

  ...

  • The Reports module is used to manage the policies more efficiently as the number of policies grow.This page will list all the policies from HDFS,HIVE,HBASE,KNOX,YARN,KAFKA,SOLR and STORM. You can perform search based on  

   

  • Policy Name    : The policy name assigned to the policy while creating it.

   

  • Resource Path : The resource path used while creating the policy.

   

  ...

  • ‘Group’ / ‘User Name’: The group and the users to which the policy is assigned

  ...

   

  Image Modified

  
  

  Image Modified

  ...

  
  

  Audit

  ...

  • Currently Ranger supports regular auditing. This includes logging at the resource level.It will support conditional auditing based on users, groups or date/time, etc.

  ...

  Access

   Access

  • Provides Service activity data for all Policies that have Audit set to On. The default service Policy is configured to log all user activity within the Service. This default policy does not contain user and group access rules.You can filter the data based on the following criteria:

   

  Search Criteria	Description
  Access Enforcer	Access enforcer indicates who made the decision to allow or deny. In case of HDFS, the enforcer would XA (Ranger) or Hadoop.
  Access Type	Type of access user has for e.g read,write
  Start date,End date	Time and date is stored for each access.A date range is used to filter the results for that particular date range.
  Service Name	The name of the service which the user tries to access
  Service Type	The type of the service which the user tries to access
  Result	This shows whether the operation was successfull or not
  User	Name of the user which tried to access the resource
  Client ip	Ip address of the user system which tried to access the resource

   

  
  

  Image Modified 

   

  Admin

  ...

  • This module Contains all events for the HDP Security Administration Web UI, including Service, Policy Manager, Log in, etc. (actions like create,update,delete,password change).You can filter the data based on the following

   

   

  Search Criteria	Description
  Action	These are operations performed on resources e.g(actions like create,update,delete,password change)
  Audit Type	There are three values Resource,asset and xa user according to operations performed on Service,policy and users.
  Session id	The session count increments each time you try to login to the system
  Start Date	Login time and date is stored for each session.A date range is used to filter the results for that particular date range
  User	Username who has performed create,update,delete operation.

   

  Image Modified

   

   

  • Difference view when we click on an operation (Update operation in this case)

  ...

  Image Modified

   

  Logging Session

  ...

  • This module logs the information related to the sessions for each login.You can filter the data based on

   

   

  Search Criteria	Description
  End Date,Start Date	Login time and date is stored for each session.A date range is used to filter the results for that particular date range
  Ip	The IP of the system through which we log in
  Login id	The user name through which you login to the system
  Login Type	The mode through which the user tries to login.(By entering username and password)
  Result	Result based on login pass or fail
  Session id	The session count increments each time you try to login to the system
  User Agent	Login time and date is stored for each session

   

  Image Modified

  • Click on session id for session details.

  Image Modified

  
  Image Modified

   

  Plugins

  ...

  • This module shows the upload history of the Security Agents.This module displays all the services Exported from the system.You can filter the data based on the followin.

  ...

   

  Search Criteria	Description
  Http Response Code	The http code which you get when you try to export the Services
  Plugin IP	Ip of the agent which tries to export the service
  Plugin Id	Name of the agent which tries to export the service
  Start Date,End Date	Export time and date is stored for each agent. A date range is used to filter the results for that particular date range.
  Service Name	The service name we are trying to export.

   

  Image Modified

  
  

  • Plugins tab is useful to check components are communicating successfully with ranger or not.

  
  

  Permissions

  ...

   

  ...

  Permissions Module

  ...

  • The aim of permission module is to provide flexibility of user roles.With the help of permission model, Admin can restrict access or assign permission to any module for non-admin users.The main purpose of Permission model is to assign dedicated roles to non-admin users based on services such as policy manager, audit, reporting, user management,Key Manager.

  
  

  Step 1: Put the pointer on Settings tab. Click on ‘Permissions’ from dropdown.
  

  Image Modified

  Step 2 : You can search the permissions by Group Name,Module Name,User Name.

  Image Modified

   

  Add / Edit Permission

  ...

  Step 3 : Click on edit button under Action column for access of particular module to selected user on permissions listing page.

  Image Modified

  Step 4 : You can select multiple users and groups from drop down.

  ...

              a.  User Permission

  Image Modified

               b.  Group Permission

  Image Modified

  Step 5 : If Steve user is having permission of only Audit and Reports tab then only this two module will be visible to to mark user on his login.

             a.  Admin Login

  Image Modified

               b.  Steve user Login

  Image Modified