forked from docs/doc-exports
Hasko, Vladimir
1746443702
Reviewed-by: Pruthi, Vineet <vineet.pruthi@t-systems.com> Co-authored-by: Hasko, Vladimir <vladimir.hasko@t-systems.com> Co-committed-by: Hasko, Vladimir <vladimir.hasko@t-systems.com>
136 lines
14 KiB
HTML
136 lines
14 KiB
HTML
<a name="admin_guide_000238"></a><a name="admin_guide_000238"></a>
|
|
|
|
<h1 class="topictitle1">Permission Verification Policies</h1>
|
|
<div id="body1529658735918"><div class="section" id="admin_guide_000238__s979ad36438c54e09967ad6d230cecb54"><h4 class="sectiontitle">Security Mode</h4><p id="admin_guide_000238__en-us_topic_0046736678_p24562296">After a user is authenticated by the big data platform, the system determines whether to verify the user's permission based on the actual permission management configuration to ensure that the user has limited or all permission on resources. If the user does not have the permission for accessing cluster resources, the system administrator must grant the required permission to the user. Otherwise, the user fails to access the resources. The cluster provides permission verification capabilities in both security mode and normal mode. The specific permission items of the components are the same in the two modes.</p>
|
|
<p id="admin_guide_000238__p14390455171710">By default, the Ranger service is installed and Ranger authentication is enabled for a newly installed cluster in security mode. You can set fine-grained security access policies for accessing component resources through the permission plug-in of the component. If Ranger authentication is not required, administrators can manually disable it on the service page. After Ranger authentication is disabled, the system continues to perform permission control based on the role model of <span id="admin_guide_000238__text67509419010">MRS</span> Manager when accessing component resources.</p>
|
|
<p id="admin_guide_000238__p576644617223">In a cluster in security mode, the following components support Ranger authentication: HDFS, YARN, Kafka, Hive, HBase, Storm, Impala, and Spark2x.</p>
|
|
<p id="admin_guide_000238__p5997645102113">For a cluster upgraded from an earlier version, Ranger authentication is not used by default when users access component resources. The administrator can manually enable Ranger authentication after installing Ranger.</p>
|
|
<p id="admin_guide_000238__en-us_topic_0046736678_p19734077">By default, all components in the cluster of the security edition authenticate access. The authentication function cannot be disabled.</p>
|
|
</div>
|
|
<div class="section" id="admin_guide_000238__s0399973afe1647999d628a5d0ea0de7f"><h4 class="sectiontitle">Normal Mode</h4><p id="admin_guide_000238__en-us_topic_0046736678_p54956439">Different components in a normal cluster use their own native open-source authentication behavior. <a href="#admin_guide_000238__ta45bf66853314ecc850b8e6d38b236e9">Table 1</a> lists detailed permission verification modes.</p>
|
|
<p id="admin_guide_000238__p1328751611431">In a normal cluster, Ranger supports permission control on component resources based on OS users. The following components support Ranger authentication: HBase, HDFS, Hive, Spark2x, and YARN.</p>
|
|
|
|
<div class="tablenoborder"><a name="admin_guide_000238__ta45bf66853314ecc850b8e6d38b236e9"></a><a name="ta45bf66853314ecc850b8e6d38b236e9"></a><table cellpadding="4" cellspacing="0" summary="" id="admin_guide_000238__ta45bf66853314ecc850b8e6d38b236e9" frame="border" border="1" rules="all"><caption><b>Table 1 </b>Component permission verification modes in normal clusters</caption><thead align="left"><tr id="admin_guide_000238__en-us_topic_0046736678_row5380904"><th align="left" class="cellrowborder" valign="top" width="25.252525252525253%" id="mcps1.3.2.4.2.4.1.1"><p id="admin_guide_000238__en-us_topic_0046736678_p33200047">Service</p>
|
|
</th>
|
|
<th align="left" class="cellrowborder" valign="top" width="32.32323232323232%" id="mcps1.3.2.4.2.4.1.2"><p id="admin_guide_000238__en-us_topic_0046736678_p4849307">Permission Verification</p>
|
|
</th>
|
|
<th align="left" class="cellrowborder" valign="top" width="42.42424242424242%" id="mcps1.3.2.4.2.4.1.3"><p id="admin_guide_000238__en-us_topic_0046736678_p57249620">Permission Verification Enabling and Disabling</p>
|
|
</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody><tr id="admin_guide_000238__row1869819183294"><td class="cellrowborder" valign="top" width="25.252525252525253%" headers="mcps1.3.2.4.2.4.1.1 "><p id="admin_guide_000238__p8699131816295">ClickHouse</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="32.32323232323232%" headers="mcps1.3.2.4.2.4.1.2 "><p id="admin_guide_000238__p1569913181294">Required</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="42.42424242424242%" headers="mcps1.3.2.4.2.4.1.3 "><p id="admin_guide_000238__p13699918162919">Not supported</p>
|
|
</td>
|
|
</tr>
|
|
<tr id="admin_guide_000238__en-us_topic_0046736678_row6707649"><td class="cellrowborder" valign="top" width="25.252525252525253%" headers="mcps1.3.2.4.2.4.1.1 "><p id="admin_guide_000238__en-us_topic_0046736678_p6448715">Flume</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="32.32323232323232%" headers="mcps1.3.2.4.2.4.1.2 "><p id="admin_guide_000238__en-us_topic_0046736678_p52583897">Not required</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="42.42424242424242%" headers="mcps1.3.2.4.2.4.1.3 "><p id="admin_guide_000238__en-us_topic_0046736678_p31437268">Not supported</p>
|
|
</td>
|
|
</tr>
|
|
<tr id="admin_guide_000238__en-us_topic_0046736678_row65119131"><td class="cellrowborder" valign="top" width="25.252525252525253%" headers="mcps1.3.2.4.2.4.1.1 "><p id="admin_guide_000238__en-us_topic_0046736678_p40158284">HBase</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="32.32323232323232%" headers="mcps1.3.2.4.2.4.1.2 "><p id="admin_guide_000238__en-us_topic_0046736678_p31595610">Not required</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="42.42424242424242%" headers="mcps1.3.2.4.2.4.1.3 "><p id="admin_guide_000238__en-us_topic_0046736678_p9107628">Supported</p>
|
|
</td>
|
|
</tr>
|
|
<tr id="admin_guide_000238__en-us_topic_0046736678_row14859795"><td class="cellrowborder" valign="top" width="25.252525252525253%" headers="mcps1.3.2.4.2.4.1.1 "><p id="admin_guide_000238__en-us_topic_0046736678_p62792710">HDFS</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="32.32323232323232%" headers="mcps1.3.2.4.2.4.1.2 "><p id="admin_guide_000238__en-us_topic_0046736678_p53044787">Required</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="42.42424242424242%" headers="mcps1.3.2.4.2.4.1.3 "><p id="admin_guide_000238__en-us_topic_0046736678_p1660480">Supported</p>
|
|
</td>
|
|
</tr>
|
|
<tr id="admin_guide_000238__en-us_topic_0046736678_row14944322"><td class="cellrowborder" valign="top" width="25.252525252525253%" headers="mcps1.3.2.4.2.4.1.1 "><p id="admin_guide_000238__en-us_topic_0046736678_p2530563">Hive</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="32.32323232323232%" headers="mcps1.3.2.4.2.4.1.2 "><p id="admin_guide_000238__en-us_topic_0046736678_p3649016">Not required</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="42.42424242424242%" headers="mcps1.3.2.4.2.4.1.3 "><p id="admin_guide_000238__en-us_topic_0046736678_p27134857">Not supported</p>
|
|
</td>
|
|
</tr>
|
|
<tr id="admin_guide_000238__en-us_topic_0046736678_row42887128"><td class="cellrowborder" valign="top" width="25.252525252525253%" headers="mcps1.3.2.4.2.4.1.1 "><p id="admin_guide_000238__en-us_topic_0046736678_p51305376">Hue</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="32.32323232323232%" headers="mcps1.3.2.4.2.4.1.2 "><p id="admin_guide_000238__en-us_topic_0046736678_p62094776">Not required</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="42.42424242424242%" headers="mcps1.3.2.4.2.4.1.3 "><p id="admin_guide_000238__en-us_topic_0046736678_p63620936">Not supported</p>
|
|
</td>
|
|
</tr>
|
|
<tr id="admin_guide_000238__en-us_topic_0046736678_row35717517"><td class="cellrowborder" valign="top" width="25.252525252525253%" headers="mcps1.3.2.4.2.4.1.1 "><p id="admin_guide_000238__en-us_topic_0046736678_p7437765">Kafka</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="32.32323232323232%" headers="mcps1.3.2.4.2.4.1.2 "><p id="admin_guide_000238__en-us_topic_0046736678_p65588106">Not required</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="42.42424242424242%" headers="mcps1.3.2.4.2.4.1.3 "><p id="admin_guide_000238__en-us_topic_0046736678_p11036355">Not supported</p>
|
|
</td>
|
|
</tr>
|
|
<tr id="admin_guide_000238__en-us_topic_0046736678_row32218335"><td class="cellrowborder" valign="top" width="25.252525252525253%" headers="mcps1.3.2.4.2.4.1.1 "><p id="admin_guide_000238__en-us_topic_0046736678_p59548322">Loader</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="32.32323232323232%" headers="mcps1.3.2.4.2.4.1.2 "><p id="admin_guide_000238__en-us_topic_0046736678_p58684749">Not required</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="42.42424242424242%" headers="mcps1.3.2.4.2.4.1.3 "><p id="admin_guide_000238__en-us_topic_0046736678_p55844233">Not supported</p>
|
|
</td>
|
|
</tr>
|
|
<tr id="admin_guide_000238__en-us_topic_0046736678_row32836053"><td class="cellrowborder" valign="top" width="25.252525252525253%" headers="mcps1.3.2.4.2.4.1.1 "><p id="admin_guide_000238__en-us_topic_0046736678_p42474604">MapReduce</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="32.32323232323232%" headers="mcps1.3.2.4.2.4.1.2 "><p id="admin_guide_000238__en-us_topic_0046736678_p17890920">Not required</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="42.42424242424242%" headers="mcps1.3.2.4.2.4.1.3 "><p id="admin_guide_000238__en-us_topic_0046736678_p39878449">Not supported</p>
|
|
</td>
|
|
</tr>
|
|
<tr id="admin_guide_000238__en-us_topic_0046736678_row5583857"><td class="cellrowborder" valign="top" width="25.252525252525253%" headers="mcps1.3.2.4.2.4.1.1 "><p id="admin_guide_000238__en-us_topic_0046736678_p49639248">Oozie</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="32.32323232323232%" headers="mcps1.3.2.4.2.4.1.2 "><p id="admin_guide_000238__en-us_topic_0046736678_p61356140">Required</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="42.42424242424242%" headers="mcps1.3.2.4.2.4.1.3 "><p id="admin_guide_000238__en-us_topic_0046736678_p3791404">Not supported</p>
|
|
</td>
|
|
</tr>
|
|
<tr id="admin_guide_000238__en-us_topic_0046736678_row13517702"><td class="cellrowborder" valign="top" width="25.252525252525253%" headers="mcps1.3.2.4.2.4.1.1 "><p id="admin_guide_000238__en-us_topic_0046736678_p21192109">Spark2x</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="32.32323232323232%" headers="mcps1.3.2.4.2.4.1.2 "><p id="admin_guide_000238__en-us_topic_0046736678_p38839231">Not required</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="42.42424242424242%" headers="mcps1.3.2.4.2.4.1.3 "><p id="admin_guide_000238__en-us_topic_0046736678_p58970022">Not supported</p>
|
|
</td>
|
|
</tr>
|
|
<tr id="admin_guide_000238__en-us_topic_0046736678_row60968157"><td class="cellrowborder" valign="top" width="25.252525252525253%" headers="mcps1.3.2.4.2.4.1.1 "><p id="admin_guide_000238__en-us_topic_0046736678_p39473694">Storm</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="32.32323232323232%" headers="mcps1.3.2.4.2.4.1.2 "><p id="admin_guide_000238__en-us_topic_0046736678_p43252647">Not required</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="42.42424242424242%" headers="mcps1.3.2.4.2.4.1.3 "><p id="admin_guide_000238__en-us_topic_0046736678_p13803553">Not supported</p>
|
|
</td>
|
|
</tr>
|
|
<tr id="admin_guide_000238__en-us_topic_0046736678_row57123120"><td class="cellrowborder" valign="top" width="25.252525252525253%" headers="mcps1.3.2.4.2.4.1.1 "><p id="admin_guide_000238__en-us_topic_0046736678_p63570006">YARN</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="32.32323232323232%" headers="mcps1.3.2.4.2.4.1.2 "><p id="admin_guide_000238__en-us_topic_0046736678_p48896832">Not required</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="42.42424242424242%" headers="mcps1.3.2.4.2.4.1.3 "><p id="admin_guide_000238__en-us_topic_0046736678_p1220438">Supported</p>
|
|
</td>
|
|
</tr>
|
|
<tr id="admin_guide_000238__en-us_topic_0046736678_row10983950"><td class="cellrowborder" valign="top" width="25.252525252525253%" headers="mcps1.3.2.4.2.4.1.1 "><p id="admin_guide_000238__en-us_topic_0046736678_p17284754">ZooKeeper</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="32.32323232323232%" headers="mcps1.3.2.4.2.4.1.2 "><p id="admin_guide_000238__en-us_topic_0046736678_p57887863">Required</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="42.42424242424242%" headers="mcps1.3.2.4.2.4.1.3 "><p id="admin_guide_000238__en-us_topic_0046736678_p58405349">Supported</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="admin_guide_000238__section71592831818"><h4 class="sectiontitle">Condition Priorities of the Ranger Permission Policy</h4><p id="admin_guide_000238__en-us_topic_0265767945_p1374519251448">When configuring a permission policy for a resource, you can configure Allow Conditions, Exclude from Allow Conditions, Deny Conditions, and Exclude from Deny Conditions for the resource, to meet unexpected requirements in different scenarios.</p>
|
|
<p id="admin_guide_000238__en-us_topic_0265767945_p18450652173817">The priorities of different conditions are listed in descending order: Exclude from Deny Conditions > Deny Conditions > Exclude from Allow Conditions > Allow Conditions</p>
|
|
<p id="admin_guide_000238__en-us_topic_0265767945_p1350585152418">The following figure shows the process of determining condition priorities. If the component resource request does not match the permission policy in Ranger, the system rejects the access by default. However, for HDFS and Yarn, the system delivers the decision to the access control layer of the component for determination.</p>
|
|
<p id="admin_guide_000238__en-us_topic_0265767945_p6252113182417"><span><img id="admin_guide_000238__en-us_topic_0265767945_image1875843317387" src="en-us_image_0000001392733938.png"></span></p>
|
|
<p id="admin_guide_000238__en-us_topic_0265767945_p966817319207">For example, if you want to grant the read and write permissions of the <strong id="admin_guide_000238__en-us_topic_0265767945_b154912581143">FileA</strong> folder to the <strong id="admin_guide_000238__en-us_topic_0265767945_b84975589148">groupA</strong> user group, but the user in the group is not <strong id="admin_guide_000238__en-us_topic_0265767945_b5497155819143">UserA</strong>, you can add an allowed condition and an exception condition.</p>
|
|
</div>
|
|
</div>
|
|
<div>
|
|
<div class="familylinks">
|
|
<div class="parentlink"><strong>Parent topic:</strong> <a href="admin_guide_000234.html">Security Overview</a></div>
|
|
</div>
|
|
</div>
|
|
|