Syncing users and groups from LDAP into Apache Ranger

The previous post covered how to install the Apache Ranger Admin service. The Apache Ranger Admin UI supports creating authorization policies for various Big Data components, by giving users and/or groups permissions on resources. This means that we need to import users/groups into the Apache Ranger Admin service from some backend service in order to create meaningful authorization policies. Apache Ranger supports syncing users into the Admin service from both unix and ldap. In this post, we'll look at syncing in users and groups from an OpenDS LDAP backend.

1) The OpenDS backend

For the purposes of this tutorial, we will use OpenDS as the LDAP server. It contains a domain called "dc=example,dc=com", and 5 users (alice/bob/dave/oscar/victor) and 2 groups (employee/manager). Victor, Oscar and Bob are employees, Alice and Dave are managers. Here is a screenshot using Apache Directory Studio:

2) Build the Apache Ranger usersync module

Follow the steps in the previous tutorial to build Apache Ranger and to setup and start the Apache Ranger Admin service. Once this is done, go back to the Apache Ranger distribution that you have built and copy the usersync module:

• tar zxvf target/ranger-0.6.0-usersync.tar.gz
• mv ranger-0.6.0-usersync ${usersync.home}

3) Configure and build the Apache Ranger usersync service 

You will need to install the Apache Ranger Usersync service using "sudo". If the root user does not have a JAVA_HOME property defined, then edit ${usersync.home}/setup.sh + add in, e.g.:

• export JAVA_HOME=/opt/jdk1.8.0_91

Next edit ${usersync.home}/install.properties and make the following changes:

• POLICY_MGR_URL = http://localhost:6080
• SYNC_SOURCE = ldap
• SYNC_INTERVAL = 1 (just for testing purposes....)
• SYNC_LDAP_URL = ldap://localhost:2389
• SYNC_LDAP_BIND_DN = cn=Directory Manager,dc=example,dc=com
• SYNC_LDAP_BIND_PASSWORD = test
• SYNC_LDAP_SEARCH_BASE = dc=example,dc=com
• SYNC_LDAP_USER_SEARCH_BASE = ou=users,dc=example,dc=com
• SYNC_GROUP_SEARCH_BASE=ou=groups,dc=example,dc=com

Now you can run the setup script via "sudo ./setup.sh". 

4) Start the Usersync service

The Apache Ranger Usersync service can be started via "sudo ./ranger-usersync-services.sh start". After 1 minute (see SYNC_INTERVAL above), it should successfully copy the users/groups from the OpenDS backend into the Apache Ranger Admin. Open a browser and go to "http://localhost:6080", and click on "Settings" and then "Users/Groups". You should see the users and groups synced successfully from OpenDS.

Installing the Apache Ranger Admin UI

Apache Ranger 0.6 has been released, featuring new support for securing Apache Atlas and Nifi, as well as a huge amount of bug fixes. It's easiest to get started with Apache Ranger by downloading a big data sandbox with Ranger pre-installed. However, the most flexible way is to grab the Apache Ranger source and to build and deploy the artifacts yourself. In this tutorial, we will look into building Apache Ranger from source, setting up a database to store policies/users/groups/etc. as well as Ranger audit information, and deploying the Apache Ranger Admin UI.

1) Build the source code

The first step is to download the source code, as well as the signature file and associated message digests (all available on the download page). Verify that the signature is valid and that the message digests match. Now extract and build the source, and copy the resulting admin archive to a location where you wish to install the UI:

• tar zxvf apache-ranger-incubating-0.6.0.tar.gz
• cd apache-ranger-incubating-0.6.0
• mvn clean package assembly:assembly 
• tar zxvf target/ranger-0.6.0-admin.tar.gz
• mv ranger-0.6.0-admin ${rangerhome}

2) Install MySQL

The Apache Ranger Admin UI requires a database to keep track of users/groups as well as policies for various big data projects that you are securing via Ranger. In addition, we will use the database for auditing as well. For the purposes of this tutorial, we will use MySQL. Install MySQL in $SQL_HOME and start MySQL via:

• sudo $SQL_HOME/bin/mysqld_safe --user=mysql

Now you need to log on as the root user and create three users for Ranger. We need a root user with admin privileges (let's call this user "admin"), a user for the Ranger Schema (we'll call this user "ranger"), and finally a user to store the Ranger audit logs in the DB as well ("rangerlogger"):

• CREATE USER 'admin'@'localhost' IDENTIFIED BY 'password';
• GRANT ALL PRIVILEGES ON * . * TO 'admin'@'localhost' WITH GRANT OPTION;
• CREATE USER 'ranger'@'localhost' IDENTIFIED BY 'password';
• CREATE USER 'rangerlogger'@'localhost' IDENTIFIED BY 'password'; 
• FLUSH PRIVILEGES;

Finally,  download the JDBC driver jar for MySQL and put it in ${rangerhome}.

3) Install the Apache Ranger Admin UI

You will need to install the Apache Ranger Admin UI using "sudo". If the root user does not have a JAVA_HOME property defined, then edit ${rangerhome}/setup.sh + add in, e.g.:

• export JAVA_HOME=/opt/jdk1.8.0_91

Next edit ${rangerhome}/install.properties and make the following changes:

• Change SQL_CONNECTOR_JAR to point to the MySQL JDBC driver jar that you downloaded above.
• Set (db_root_user/db_root_password) to (admin/password)
• Set (db_user/db_password) to (ranger/password)
• Change "audit_store" from "solr" to "db"
• Set "audit_db_name" to "ranger_audit"
• Set (audit_db_user/audit_db_password) to (rangerlogger/password).

Now you can run the setup script via "sudo ./setup.sh".

4) Starting the Apache Ranger admin service

After a successful installation, we can start the Apache Ranger admin service with "sudo ranger-admin start". Now open a browser and go to "http://localhost:6080/". Log on with "admin/admin" and you should be able to create authorization policies for a desired big data component.