Cloudera Docs

Handling inconsistent username and group name conventions for consistent authorization

This document explains how user and group names are processed to ensure that Ranger policies are applied correctly, leading to seamless access to data and resources.

Cloudera offers a standardized method for managing usernames and group names to ensure consistent and accurate authorization across all Cloudera services. This approach is particularly useful when dealing with diverse naming conventions, including special characters such as whitespace and slashes.

You often use a variety of naming conventions for users and groups in your identity providers, for example, Active Directory or LDAP. These conventions can include special characters that, if not handled consistently, can lead to potential inconsistencies in authorization and increased administrative overhead.

Earlier, it was necessary to manually set the following user/group name conversion properties in the ranger-admin-site.xml file, and these values had to match those configured in the Ranger Usersync component:
  • ranger.plugins.conf.ldap.username.caseconversion
  • ranger.plugins.conf.ldap.groupname.caseconversion
  • ranger.plugins.conf.mapping.username.handler
  • ranger.plugins.conf.mapping.groupname.handler
  • ranger.plugins.conf.mapping.regex.separator
  • ranger.plugins.conf.mapping.username.regex
  • ranger.plugins.conf.mapping.groupname.regex
From Cloudera Runtime 7.3.2.0 onwards, support has been added to expose the following Ranger Usersync configurations on Cloudera Manager and in the ranger-admin-site.xml file to manage usernames and group names seamlessly to ensure consistent and accurate authorization:
  • ranger.usersync.ldap.username.caseconversion
  • ranger.usersync.ldap.groupname.caseconversion
  • ranger.usersync.mapping.username.handler
  • ranger.usersync.mapping.groupname.handler
  • ranger.usersync.mapping.regex.separator
  • ranger.usersync.mapping.username.regex
  • ranger.usersync.mapping.groupname.regex

To handle inconsistent user and group naming conventions, perform the following steps:

Configure the safety valve at service level.
  1. Go to Cloudera Manager > <Service> > Configuration.
  2. Set the ranger.plugin.<serviceType>.supports.name.transformation safety valve to the service-level configuration.
    For example, ranger.plugin.hive.supports.name.transformation.