Once the identity of the end user is established via Kerberos authentication, the next step in Hadoop security is to ensure what actions or services those established identities can perform. Authorization deals with that. In the following sections, we will look into how authorization rules can be established for different users across different services and how data is stored in HDFS. We will look into two different types of tools that facilitate centralized security policy management for authorization. Let's look into these in brief.
The following diagram represents the architecture of the Ranger tool, which lets you centrally manage security policies for different Hadoop services:
As shown in the preceding diagram, all policies are centrally managed through an administrative web portal. The portal has three distinct parts, namely auditing, KMS, and the policy server. The policy server has several different functionalities. The following are the prime functions of...