THIS IS A TEST INSTANCE. ALL YOUR CHANGES WILL BE LOST!!!!
Summary
In order to install Ranger in kerberized environment, user will have to enable kerberos on the cluster where Ranger is to be installed. Once, cluster is kerberized, user will have to create principals for each Ranger service and then follow below given steps to install Ranger.
Creating Keytab and principals
Note: Below steps required only for manual installation of ranger services and plugins
Do some initial Checks :
Login as “ranger” user:
If ranger user not found then create it i.e. useradd ranger
E.g : su - ranger
Check for HTTP Principal
-> kinit -kt <HTTP keytab path> HTTP/<FQDN_OF_Ranger_Admin_Cluster>@<REALM>
E.g : kinit -kt /etc/security/keytabs/spnego.service.keytab HTTP/mp-ranger-0703-3.novalocal@EXAMPLE.COM
(After above command there should not be any error. You can check using “klist” whether the above command was successful)
-> kdestroy (Please don't miss kdestroy after above step)
For Ranger Admin:
- Create rangeradmin/<FQDN of Ranger Admin>@<REALM>
-> kadmin.local
-> addprinc -randkey rangeradmin/<FQDN of Ranger Admin>
Eg: addprinc -randkey rangeradmin/mp-ranger-0703-3.novalocal@EXAMPLE.COM
-> xst -k /etc/security/keytabs/rangeradmin.keytab rangeradmin/<FQDN of Ranger Admin>@<REALM>
-> exit - Check ranger-admin created principal
-> kinit -kt /etc/security/keytabs/rangeradmin.keytab rangeradmin/<FQDN of Ranger Admin>@<REALM>
E.g : kinit -kt /etc/security/keytabs/rangeradmin.keytab rangeradmin/mp-ranger-0703-3.novalocal@EXAMPLE.COM
(After above command there should not be any error. You can check using “klist” whether the above command was successful)
-> kdestroy (Please don’t miss kdestroy after above step)
For Ranger Lookup:
Create rangerlookup/<FQDN of Ranger Admin>@<REALM>
-> kadmin.local
-> addprinc -randkey rangerlookup/<FQDN of Ranger Admin>
Eg: addprinc -randkey rangerlookup/mp-ranger-0703-3.novalocal@EXAMPLE.COM
-> xst -k /etc/security/keytabs/rangerlookup.keytab rangerlookup/<FQDN of Ranger Admin>@<REALM>
-> exit
Check ranger-lookup created principal
-> kinit -kt /etc/security/keytabs/rangerlookup.keytab rangerlookup/<FQDN of Ranger Admin>@<REALM>
E.g : kinit -kt /etc/security/keytabs/rangerlookup.keytab rangerlookup/mp-ranger-0703-3.novalocal@EXAMPLE.COM
(After above command there should not be any error u can check using “klist” whether the above command was successful)
-> kdestroy (Please don’t miss kdestroy after above step)
For Ranger Usersync:
Create rangerusersync/<FQDN>@<REALM>
-> kadmin.local
-> addprinc -randkey rangerusersync/<FQDN of Ranger usersync>
Eg: addprinc -randkey rangerusersync/mp-ranger-0703-3.novalocal@EXAMPLE.COM
-> xst -k /etc/security/keytabs/rangerusersync.keytab rangerusersync/<FQDN>@<REALM>
-> exit
Check rangerusersync created principal
-> kinit -kt /etc/security/keytabs/rangerusersync.keytab rangerusersync/<FQDN of Ranger usersync>@<REALM>
E.g : kinit -kt /etc/security/keytabs/rangerusersync.keytab rangerusersync/mp-ranger-0703-3.novalocal@EXAMPLE.COM
(After above command there should not be any error u can check using “klist” whether the above command was successful)
-> kdestroy (Please don’t miss kdestroy after above step)
For Ranger Tagsync:
Create rangertagsync/<FQDN>@<REALM>
-> kadmin.local
-> addprinc -randkey rangertagsync/<FQDN of Ranger tagsync>
Eg: addprinc -randkey rangertagsync/mp-ranger-0703-3.novalocal
-> xst -k /etc/security/keytabs/rangertagsync.keytab rangertagsync/<FQDN>@<REALM>
-> exit
Check rangertagsync created principal
-> kinit -kt /etc/security/keytabs/rangertagsync.keytab rangertagsync/<FQDN of Ranger tagsync>@<REALM>
E.g : kinit -kt /etc/security/keytabs/rangertagsync.keytab rangertagsync/mp-ranger-0703-3.novalocal@EXAMPLE.COM
(After above command there should not be any error u can check using “klist” whether the above command was successful)
-> kdestroy (Please don’t miss kdestroy after above step)
Note: Change the keytab permission to read only and assign it to “ranger” user