[HAWQ-256] Integrate Security with Apache Ranger

• Type: New Feature
• Status: In Progress
• Priority: Major
• Resolution: Unresolved
• Fix Version/s: backlog
• Component/s: Security
• Assignee: Lili Ma
• Reporter: Michael Andre Pearce
• Created: 15/Dec/15 19:24
• Updated: 15/Feb/17 06:36

Description

Integrate security with Apache Ranger for a unified Hadoop security solution.

Issue Links

• is related to: RANGER-782 Add support for Apache Hawq
• relates to: HAWQ-1118 Support user impersonation for HAWQ internal tables
• relates to: HAWQ-1036 Support user impersonation in PXF for external tables

Sub-Tasks

• Implement HAWQ basic user ACL check through Ranger: Closed
• Implement configuration GUC related to Ranger.: Resolved
• Implement batched ACL check through Ranger.: Open
• Implement calling Ranger REST Service using libcurl.: Resolved
• HAWQ sync user information from LDAP: Open
• Implement Ranger Plugin Service which holds HAWQ Ranger Plugin and provide REST Service: Resolved
• Add one option in Ambari to enable user to specify whether they want enable Ranger for ACL check: Open
• Change hawq start script once finding enable_ranger GUC is on.: Closed
• Process catalog table ACL on Ranger.: Resolved
• Gpadmin super user processing on ACL: Open
• Support ranger plugin server HA in hawq side.: Open
• Add generation of RequestID, ClientIP, queryContext(SQL Statement) in HAWQ , and encapsulate these contents to JSON request to RPS: Closed
• Don't do ACL checks on segments: Closed
• Enhance libcurl connection to RPS(Ranger Plugin Service), keep it as a long-live connection in session level: Closed
• If user doesn't have privileges on certain objects, need return user which specific table he doesn't have right.: Closed
• Check build-in catalogs, tables and functions in native aclcheck.: Resolved
• The error message is not friendly when ranger plugin service is unavailable.: Closed
• Force to recompute namespace_path when enable_ranger: Closed
• Add integration tests to Ranger Plugin Service project: Resolved
• Reduce unnecessary calls of namespace check when run \d: Closed
• Change GUC enable_ranger(bool) to a text GUC(hawq_acl_type), which can allow other kinds of ACL.: Closed
• Remove ALL privilege for HAWQ service in Ranger: Closed
• Package all configuration files for RPS and Tomcat into hawq-ranger-plugin.rpm: Resolved
• Optimize the performance of hawq with ranger enabled.: Open
• Forbid grant/revoke command in HAWQ side once Ranger is configured.: Resolved
• Change RPM name for RPS to hawq-ranger-plugin: Resolved
• Allow queries related to pg_temp if ranger is enable: Resolved
• Add deny and exclude policy template for hawq service in ranger.: Resolved
• pg_catalog view fallback failed: Closed
• Add --enable-rps option to build ranger-plugin when build hawq.: Closed
• Provide template for Ranger access audit to Solr from RPS: Resolved
• Externalize JVM params from rps.sh into rps.properties: Resolved
• Add policy test for HAWQ with Ranger enabled.: Closed
• Add RPS start/stop script in HAWQ start/stop script: Closed
• Keep hawq_toolkit schema check in HAWQ native side: Closed
• HAWQ Sends Wrong Request to RPS for PXF Hcatalog: Resolved
• Add basic test case for hcatalog with ranger: Closed
• Set JAVA_HOME / JRE_HOME for RPS in the scripts: Resolved
• RPS test RangerHawqAuthorizerServiceNameTest fails sometimes: Resolved
• Provide user-group membership in RPS when requesting access: Resolved
• Implement RPS High availability on HAWQ: Closed
• Implement SSL Access from RPS to Ranger: Open
• Implement Ranger lookup for HAWQ with Kerberos enabled.: Open
• HAWQ start/stop cluster should be able to start/stop RPS on standby node: Closed
• HAWQ state should be able to report the status of both RPS and standby RPS: Closed
• Remove hawq_rps_address_suffix and hawq_rps_address_host in hawq-site.xml to simplify configuration for RPS High Availability: Closed
• Copy RPS configuration files to standby in specific scenarios: Closed
• Don't expose RPS warning messages to command line: Resolved
• Augment enable-ranger-plugin.sh to support kerberos.: Closed
• Ranger-plugin connect to Ranger admin under kerberos security.: Closed
• Use user/password instead of credentials cache in Ranger lookup for HAWQ with Kerberos enabled.: Closed
• Integrate Ranger lookup JAAS configuration in ranger-admin plugin jar: Closed