Configure Ranger Authentication for LDAP

How to configure Ranger to use LDAP for user authentication.

You can configure Ranger authentication in two ways:

• During installation: Ranger Customize Services > Advanced tab > Ranger Settings
• After installation: Ambari > Ranger > Configs > Advanced > Ranger Settings

1. From the Ranger Settings tab:
   1. Enter the external URL, e.g. http://my-vm.hortonworks.com:6080.
   2. Under Authentication method, select LDAP.
   3. Under HTTP enabled, make a selection. This option enables you to select HTTP/HTTPS communication for Ranger admin console. If you disable HTTP, only HTTPS is allowed. HTTP is enabled by default.
2. From the LDAP Settings tab, enter the following values:

   Property	Description	Default value	Sample values
   Group Search Base		{{ranger_ug_ldap_group_searchbase}}
   Group Search Filter		{{ranger_ug_ldap_group_searchfilter}}
   LDAP URL		{{ranger_ug_ldap_url}}
   Bind User		{{ranger_ug_ldap_bind_dn}}
   Bind User Password		N/A
   User Search Filter		(uid={0})
   ranger.ldap.base.dn		dc=example,dc=com
   ranger.ldap.group.roleattribute		cn
   ranger.ldap.referral	See below.	ignore	follow|throw|ignore
   ranger.ldap.user.dnpattern		uid={0},ou=users,dc=xasecure,dc=net

   There are three possible values for ranger.ldap.ad.referral: follow, throw, and ignore. The recommended setting is follow.

   When searching a directory, the server might return several search results, along with a few continuation references that show where to obtain further results. These results and references might be interleaved at the protocol level.

   • When this property is set to follow, the AD service provider processes all of the normal entries first, and then follows the continuation references.

   • When this property is set to throw, all of the normal entries are returned in the enumeration first, before the ReferralException is thrown. By contrast, a "referral" error response is processed immediately when this property is set to follow or throw.

   • When this property is set to ignore, it indicates that the server should return referral entries as ordinary entries (or plain text). This might return partial results for the search. In the case of AD, a PartialResultException is returned when referrals are encountered while search results are processed.