Managing Apache Kudu Security

Enable Ranger authorization

You can configure fine-grained authorization using Apache Ranger. This topic provides the steps to enable Kudu's integration with Ranger from Cloudera Manager.

From Cloudera Manager, go to Clusters > Kudu > Configurations.
Select the Ranger Service with which Kudu should authorize requests.
If Ranger high-availability is enabled for the cluster, add a Kudu service repository with the following configurations through the Ranger Admin web UI is required:
```
# This example setup configures the Kudu service user as a privileged user to be
# able to retrieve authorization policies stored in Ranger.

<property>
  <name>policy.download.auth.users</name>
  <value>kudu</value>
</property>
```
The name of the added Kudu service repository needs to match the one specified in ranger.plugin.kudu.service.name of the Ranger client ranger-kudu-security.xml configuration file.

note
When a Kudu client opens a table, the Kudu Master will authorize all possible actions the user may want to perform on the given table (ALL, and if it’s not allowed, then INSERT, SELECT, UDPATE, DELETE). This results in auditing these requests when a client opens a table, even if they’ll never do any of these operations.