Re: ranger for cassandra

2017-04-20 Thread Don Bosco Durai
It’s been a while. Here are 2 classes I looked at: https://github.com/apache/cassandra/blob/81f6c784ce967fadb6ed7f58de1328e713eaf53c/src/java/org/apache/cassandra/auth/IAuthorizer.java https://github.com/apache/cassandra/blob/81f6c784ce967fadb6ed7f58de1328e713eaf53c/src/java/org/apache/cassandra/

RE: usersync and Ranger UI Login

2017-04-20 Thread Jon Morisi
I think there is an issue with a keystore, as you have suggested. I’m looking for the location for the correct keystore where I would import my certificate from AD for Ranger-Admin. Is this the correct location: ranger.credential.provider.path? It seems like the jceks file associated with that,

RE: usersync and Ranger UI Login

2017-04-20 Thread Jon Morisi
I have enabled debug following this: https://community.hortonworks.com/content/supportkb/49445/how-to-enable-debug-logging-for-ranger-admin.html I do not see any “Bad Credentials” errors in xa_portal.log I will look through https://issues.apache.org/jira/browse/RANGER-840 and attempt to impleme

Re: usersync and Ranger UI Login

2017-04-20 Thread Sailaja Polavarapu
Hi Jon, Just an FYI: Usersync and ranger admin are two different processes and can you different trust stores for accessing root certs. These trust store paths are configurable in Ranger as well as in usersync (https://issues.apache.org/jira/browse/RANGER-840). Hence usersync working fine with

RE: usersync and Ranger UI Login

2017-04-20 Thread Jon Morisi
Usersync is working, configured with LDAPS. My xa_portal.log file does have errors including this one which seems to have a related JIRA: https://issues.apache.org/jira/browse/RANGER-1073 WARN org.apache.hadoop.fs.ChecksumFileSystem$ChecksumFSInputChecker (ChecksumFileSystem.java:165) - Problem

Re: usersync and Ranger UI Login

2017-04-20 Thread Sailaja Polavarapu
Since you are using ldaps, I am assuming the ssl handshake pass. Have you noticed any errors in ranger admin logs (xa_portal.log)? Can you enable debug level for ranger admin logs? And if possible, can you try strace (if using ldaps) or tcpdump (if using ldap)? The trace will tell exactly what t

RE: usersync and Ranger UI Login

2017-04-20 Thread Jon Morisi
That is successful. I used my Domain\sAMAccountName for the –D parameter of ldapsearch and received a successful query response from AD. ldapsearch -H ldaps://[myserver]:636 -x -D ‘Domain\sAMAccountName ' -W -b ‘[basedn]' -d 1 Thanks, Jon From: Sailaja Polavarapu [mailto:spolavar...@hortonwor