Understanding the Ranger Authorization Process for CFM

Selecting Ranger as a dependency during installation, indicates that Ranger must be used for NiFi and NiFi Registry authorization.

When Ranger is selected, the NiFi and NiFi Registry CSD scripts perform the following steps:
  • Create a new repository/service in Ranger to store policies for the given NiFi or NiFi Registry instance. Each instance appears on the Ranger UI with a unique name in the following format: <CM cluster name>_nifi or <CM cluster name>_nifiregistry.

    Example: myCFMcluster_nifi

  • Create policies for the following Initial Admin Identity and Initial Admin Groups:
    • For NiFi: nifi.initial.admin.identity and nifi.initial.admin.groups
    • For NiFi Registry: nifi.registry.initial.admin.identity and nifi.registry.initial.admin.groups
  • Create policies for proxies specified by nifi.proxy.group or nifi.registry.proxy.group.

Each authorizers.xml file produced in NiFi and NiFi Registry when using Ranger, contains the following logical configuration:

  • CompositeConfigurableUserGroupProvider
    • FileUserGroupProvider
    • CMUserGroupProvider
  • RangerAuthorizer
    • Configured with CompositeConfigurableUserGroupProvider
The CMUserGroupProvider has the following purposes:
  • Obtain the NiFi node identities (and Knox identity if present) from Cloudera Manager.
  • Associate the NiFi node identities with a group.

The group associated with the identies is used as the proxy group that is placed in the Ranger policy for the/proxy resource.