SecurityPDF version

Configuring Ranger policies for Cloudera SQL Stream Builder

You must add Cloudera SQL Stream Builder service user named ssb to the Ranger policies that are used by Kafka, Schema Registry, Hive and Kudu to provide access to topics, schemas and tables provided by the components.

Before you begin
You can reach the Ranger User Interface through Cloudera Manager:
  1. Go to your cluster in Cloudera Manager.
  2. Select Ranger from the list of services.
  3. Click on Ranger Admin Web UI.

    You are redirected to the Ranger Admin Web UI.

You must add the ssb user to the following policies:
  • all-consumergroup
  • all-topic
  1. Select cm_kafka from the Service Manager home page on the Ranger Admin Web UI.

    You are redirected to the list of Kafka policies page.

  2. Click on the edit button of the all-consumergroup policy.
  3. Add the Cloudera SQL Stream Builder user to the Select User field under the Allow Conditions setting.
  4. Click Save.

    You are redirected to the list of Kafka policies page

  5. Click on + More… to check if the Cloudera SQL Stream Builder user is listed under the Users for the consumergroup policy.
  6. Add the ssb user to the following policy with the above steps as well:
    • all-topic

You must add the ssb user to the following policy:
  • all-schema-group, schema-metadata, schema-branch, schema-version
  1. Select cm_schema-registry from the Service Manager home page on the Ranger Admin Web UI.

    You are redirected to the list of Schema Registry policies page.

  2. Click on the edit button of the all-schema-group, schema-metadata, schema-branch, schema-version policy.
  3. Add the ssb user to the Select User field under the Allow Conditions setting.
  4. Click Save.

    You are redirected to the list of Schema Registry policies page.

  5. Click on + More… to check if the Cloudera SQL Stream Builder user is listed under the Users for the schema-group, schema-metadata, schema-branch, schema-version policy.

You must add the ssb user to the following policy:
  • all-global
  • all-database, table, column
  • all-database, table
  • all-database
  • all-hiveservice
  • all-database, udf
  • all-url
  1. Select cm_hadoopsql from the Service Manager home page on the Ranger Admin Web UI.

    You are redirected to the list of Hadoop SQL policies page.

  2. Click on the edit button of the all-global policy.
  3. Add the Cloudera SQL Stream Builder user to the Select User field under the Allow Conditions setting.
  4. Click Save.

    You are redirected to the list of Hadoop SQL policies page.

  5. Click on + More… to check if the Cloudera SQL Stream Builder user is listed under the Users for the all-global policy.
  6. Add the ssb user to the following policy with the above steps as well:
    • all-database, table, column
    • all-database, table
    • all-database
    • all-hiveservice
    • all-database, udf
    • all-url

You must create a policy to grant access to Kudu tables for the ssb user.

  1. Select cm_kudu from the Service Manager home page on the Ranger Admin Web UI.

    You are redirected to the Create Policy page.

  2. Click on Add New Policy.
  3. Provide a name to the Policy Name field.
  4. Provide a prefix for the Databases you want to add to the policy or type * to select all.
  5. Provide a prefix for the table you want to add to the policy or type * to select all.
  6. Provide a prefix for the column you want to add to the policy or type * to select all.
  7. Add the ssb user to the Select User field under the Allow Conditions setting.
  8. Click on the plus icon to Add Permissions to the Permissions field.
  9. Click on the specific permissions or Select All.
  10. Click on Add at the bottom of the page.

    You are redirected to the list of Kudu policies page where the created policy should be listed.

  11. Click on + More… to check if the ssb user is listed under the Users for the created policy.