Ranger overview - E-MapReduce - Alibaba Cloud Documentation Center

Apache Ranger is a centralized security framework that provides fine-grained access control for Hadoop ecosystem components such as HDFS, Hive, and YARN, with a web UI for administration.

Ranger components

Ranger consists of three modules:

Ranger Admin
You can use Ranger Admin to create and update access policies. The policies are stored in a database. The plug-ins for Hadoop components poll the access policies on a regular basis.
Ranger Plug-ins
The plug-ins for Hadoop components are embedded in cluster processes as lightweight Java programs. For example, the Hive plug-in is embedded in the Hiveserver2 process. The plug-ins obtain policies from Ranger Admin and store the policies in local files. When Ranger receives a request from a user of a Hadoop component, the plug-in for the component obtains the request, and then evaluates the request based on the access policies.
Ranger UserSync
UserSync is a user information synchronization tool. It is used to fetch user and user group information from the UNIX system or an LDAP server. The information is stored in the database of Ranger Admin and is used to define policies.

Access the Ranger UI

Add port 8443. For more information, see Add a security group rule.
Go to the Access Links and Ports tab.
1. Log on to the E-MapReduce console.
2. In the top navigation bar, select a region and a resource group based on your requirements.
3. On the EMR on ECS page, click the name of the target cluster.
4. Click the Access Links and Ports tab.
On the Access Links and Ports page, click the link in the Ranger UI row.
On the Ranger UI logon page, enter the username and password.
- For DataLake clusters
  - For EMR-3.44.0 and later or EMR-5.10.0 and later:
    
    The default username is admin, and the default password is Admin1234.
  - For versions earlier than EMR-3.44.0 or EMR-5.10.0:
    
    The default username is admin, and the default password is admin1234.
- For Hadoop clusters
  
  The default username and password are both admin.
If you forget the default password, see FAQ.
After you log on for the first time, change the password and store it securely.
Note
For versions earlier than EMR-3.53.0 and EMR-5.19.0 , do not change the password. If you change the admin user password through the Ranger UI, some components or logs might report the following error:
```
Request failed. loginId=null, logMessage="RANGER_ERROR_SERVICE_NOT_FOUND: ServiceName=emr-dls"
javax.ws.rs.WebApplicationException: null
```
This occurs because other cluster services still use the old password to connect to Ranger Admin, causing authentication failures.

Solution: Revert the password to the initial password.
```
mysql -urangeradmin -prangeradmin1234 
update ranger.x_portal_user set password="257e4521fee681b67583e2e7a4ac1c28" where login_id="admin";
```
1. Click Settings in the top navigation bar.
2. Change the password for the admin user.
3. In the upper-right corner, click admin > Log Out.
  
  You can then log on with the new password.

FAQ

Maintain permissions after a password change

For clusters running EMR-3.53.0 or later and EMR-5.19.0 or later, after you change the admin password in the Ranger UI, you must also update the ranger.admin.password configuration item on the Configure tab of the Ranger service in the E-MapReduce console. Otherwise, enabling or disabling Ranger-based permission control for components may fail.

Log on to the E-MapReduce console.
Go to the Ranger service configuration page.
1. In the Actions column of the target cluster, click Services.
2. In the Ranger service section, click Configure.
Search for the ranger.admin.password configuration item and update its value to the new password.
Save the configuration and follow the prompts to apply the changes.

Forgot your Ranger UI password?

Log on to the master node of the cluster. For more information, see Log on to a cluster.

Run the following command to reset the admin password to the initial password.

DataLake cluster

For EMR-3.44.0 and later or EMR-5.10.0 and later:

mysql -urangeradmin -pRangeradmin1234 
update ranger.x_portal_user set password="07e47d323c1c36c1dc2cc3966027d6f9" where login_id="admin";

For versions earlier than EMR-3.44.0 or EMR-5.10.0:

mysql -urangeradmin -prangeradmin1234 
update ranger.x_portal_user set password="257e4521fee681b67583e2e7a4ac1c28" where login_id="admin";

Hadoop cluster

mysql -urangeradmin -prangeradmin 
update ranger.x_portal_user set password="ceb4f32325eda6142bd65215f4c0f371" where login_id="admin";