当前位置：首页 > ds >正文

Apache Ranger 权限管理

ds 2025/7/26 17:21:36

编译

mvn install package -DskipTests -Dfast -Drat.skip=true -Dmaven.test.skip=true -Dcheckstyle.skip=true -Denforcer.skip=true

在这里插入图片描述

install.properties

PYTHON_COMMAND_INVOKER=python#DB_FLAVOR=MYSQL|ORACLE|POSTGRES|MSSQL|SQLA
DB_FLAVOR=MYSQL
##
# Location of DB client library (please check the location of the jar file)
#
#SQL_CONNECTOR_JAR=/usr/share/java/ojdbc6.jar
#SQL_CONNECTOR_JAR=/usr/share/java/mysql-connector-java.jar
#SQL_CONNECTOR_JAR=/usr/share/java/postgresql.jar
#SQL_CONNECTOR_JAR=/usr/share/java/sqljdbc4.jar
#SQL_CONNECTOR_JAR=/opt/sqlanywhere17/java/sajdbc4.jar
SQL_CONNECTOR_JAR=/data/app/apache-ranger/mysql-connector-java-5.1.47.jardb_root_user=root
db_root_password=OIRLkZvqIQyB
db_host=localhost:3306
#SSL config
db_ssl_enabled=false
db_ssl_required=false
db_ssl_verifyServerCertificate=false
#db_ssl_auth_type=1-way|2-way, where 1-way represents standard one way ssl authentication and 2-way represents mutual ssl authentication
db_ssl_auth_type=1-way
javax_net_ssl_keyStore=
javax_net_ssl_keyStorePassword=
javax_net_ssl_trustStore=
javax_net_ssl_trustStorePassword=
javax_net_ssl_trustStore_type=jks
javax_net_ssl_keyStore_type=jks# For postgresql db
db_ssl_certificate_file=#
# DB UserId used for the Ranger schema
#
db_name=ranger
db_user=ranger
db_password=OIRLkZvqIQyB#For over-riding the jdbc url.
is_override_db_connection_string=false
db_override_connection_string=# change password. Password for below mentioned users can be changed only once using this property.
#PLEASE NOTE :: Password should be minimum 8 characters with min one alphabet and one numeric.
rangerAdmin_password=Ranger123456
rangerTagsync_password=Ranger123456
rangerUsersync_password=Ranger123456
keyadmin_password=Ranger123456#Source for Audit Store. Currently solr, elasticsearch and cloudwatch logs are supported.
# * audit_store is solr
audit_store=solraudit_elasticsearch_password=
audit_elasticsearch_index=
audit_elasticsearch_bootstrap_enabled=true# * audit_solr_url URL to Solr. E.g. http://<solr_host>:6083/solr/ranger_audits
audit_solr_urls=http://192.168.1.49:8983/solr/ranger_audits
audit_solr_user=
audit_solr_password=
audit_solr_zookeepers=192.168.1.49:2181audit_solr_collection_name=ranger_audits
#solr Properties for cloud mode
audit_solr_config_name=ranger_audits
audit_solr_configset_location=
audit_solr_no_shards=1
audit_solr_no_replica=1
audit_solr_max_shards_per_node=1
audit_solr_acl_user_list_sasl=solr,infra-solr
audit_solr_bootstrap_enabled=true# * audit to amazon cloudwatch properties
audit_cloudwatch_region=
audit_cloudwatch_log_group=
audit_cloudwatch_log_stream_prefix=#------------------------- DB CONFIG - END ----------------------------------#
# ------- PolicyManager CONFIG ----------------
#policymgr_external_url=http://192.168.1.49:6080
policymgr_http_enabled=true
policymgr_https_keystore_file=
policymgr_https_keystore_keyalias=rangeradmin
policymgr_https_keystore_password=

`setup.sh`

[root@localhost lib]# ll
total 132
-rw-r--r-- 1 ranger ranger 19516 Jul 25 16:55 credentialbuilder-3.0.0-SNAPSHOT.jar
-rw-r--r-- 1 ranger ranger 29240 Jul 25 16:34 jisql-3.0.0-SNAPSHOT.jar
-rw-r--r-- 1 ranger ranger 78146 Jul 25 16:39 jopt-simple-5.0.4.jar
[root@localhost lib]# pwd
/data/app/apache-ranger/ranger-3.0.0-SNAPSHOT-admin/jisql/lib

在这里插入图片描述

ranger-admin

[root@localhost lib]# ranger-admin --help
Invalid argument [--help];
Usage: Only start | stop | restart | metric | version, are supported.
For metric Usage: metric -type policies | audits | usergroup | services | database | contextenrichers | denyconditions

在这里插入图片描述

整合 StarRocks 管理权限

参考：https://docs.starrocks.io/zh/docs/3.2/administration/user_privs/ranger_plugin/

curl -u admin:Ranger123456  -X POST -H "Accept: application/json" \
-H "Content-Type: application/json" \
http://hadoop03:6080/service/plugins/definitions -d@ranger-servicedef-starrocks.json

在这里插入图片描述

用户同步模块

setup.sh
在这里插入图片描述

[root@hadoop03 ranger-3.0.0-SNAPSHOT-usersync]# ranger-usersync start
Starting Apache Ranger Usersync Service
Apache Ranger Usersync Service with pid 84109 has started.

在这里插入图片描述