Configuring Ranger authorization for Solr service
By default, the Solr service is not configured for authorization by Ranger. You can configure authorization manually, using Cloudera Manager.
Minimum Required Role: Cluster Administrator (also provided by Full Administrator)
- In the Cloudera Manager Admin Console, go to the Ranger service.
- On the Service Manager page, click the Add icon next to Solr.
-
Enter the following information on the Create Service
page:
Service Details
Field name Description Service Name Assign a name to the Solr service you want to create.
Note down the value you define here. You need to enter it later, when specifying the
ranger.plugin.solr.service.name
parameter in the Solr Service Advanced Configuration Snippet (Safety Valve) for ranger-solr-security.xml option.Active Status Enabled Select Tag Service Select cm_tag. Configuration Properties
Field name Description Username Assign a placeholder value. This property is not used in case of Kerberos authentication. Password Assign a placeholder value. This property is not used in case of Kerberos authentication. Solr URL Assign a placeholder value. This property is not used in case of Kerberos authentication. Add new configurations Add the following new configurations:
-
policy.download.auth.users = solr
-
tag.download.auth.users = solr
-
- Click Save.
- Click on the name of the newly added service.
- Under Action click the Edit icon.
-
In Allow Conditions > Select User dropdown select
hue
.This is necessary because the Hue service breaks if it has no permission to access Solr.To keep the cluster accessible to non-admin users, you can add other users to the default policy or you can define additional policies.
-
Grant full admin privileges to users that you want to be able to access the
Solr Admin UI.
- Click Add under Allow Conditions to add a new condition, then add the user or users from the Select User drop-down.
- Click Add Permissions then select the Select/Deselect All option.
- Accept the selection, then click Save.
- In the Cloudera Manager Admin Console, go to the Solr service.
- Click the Configuration tab.
- In the Search field start typing ‘safety’
- Click Add under Solr Service Advanced Configuration Snippet (Safety Valve).
-
Define the following:
- Key
ranger.plugin.solr.service.name
- Value
-
The Solr Service Name you assigned when creating the Solr service in Ranger.
- Click Save Changes.
- Click the Status tab to refresh the window.
- Click the Stale Configuration: Restart needed indicator on top of the page.
- Click Restart Stale Services.
- Click Restart Now.