Authenticating users in the Apache Ranger Admin Service via LDAP

In the summer, I wrote a couple of blog posts covering how to configure and install the Apache Ranger Admin Service and then how to use the Apache Ranger usersync Service to import users and groups from LDAP into the Apache Ranger Admin Service. The Usersync service periodically imports all users and groups that matches the configured search base into the Apache Ranger Admin service. However, this bulk import of users and groups might be unnecessary for your particular requirements. In this post we will show instead how to authenticate users logging in to the Apache Ranger Admin Service UI using LDAP.

1) The OpenDS backend

As with the tutorial on the Apache Ranger usersync service, we will use OpenDS as the LDAP server. It contains a domain called "dc=example,dc=com", and 5 users (alice/bob/dave/oscar/victor) and 2 groups (employee/manager). Victor, Oscar and Bob are employees, Alice and Dave are managers. Here is a screenshot using Apache Directory Studio:

2) Configuring the Apache Ranger Admin Service to use LDAP for authentication

Follow the steps in the following tutorial to build Apache Ranger and to setup and install the Apache Ranger Admin service. Edit 'conf/ranger-admin-site.xml' and change/specify the following configuration values:

• ranger.authentication.method: LDAP
• ranger.ldap.url: ldap://localhost:2389
• ranger.ldap.user.dnpattern: cn={0},ou=users,dc=example,dc=com
• ranger.ldap.group.searchbase: ou=groups,dc=example,dc=com
• ranger.ldap.group.searchfilter: (member=cn={1},ou=users,dc=example,dc=com)
• ranger.ldap.group.roleattribute: cn
• ranger.ldap.base.dn: dc=example,dc=com
• ranger.ldap.bind.dn: cn=Directory Manager,dc=example,dc=com
• ranger.ldap.bind.password: test

Note that the "group" configuration attributes must be specified, even though the group information is not actually used. I've submitted a patch for this which should be fixed for the next Ranger release. Now simply save the changes to 'conf/ranger-admin-site.xml' and start the Apache Ranger Admin service. You should be able to log on to http://localhost:6080/login.jsp using the LDAP credentials store in OpenDS.