在普通hadoop集群下網上已經有很多講解，一般參考官方wiki就可以，整體安裝也比較簡單，這里可以參考。但是在安全集群中，需要通過keberos認證進行策略同步等使用，遇見主要有兩個問題：1.策略同步失敗；2.測試連接失敗；下面提供自己遇見過后的處理方式。

策略同步失敗

如果在install.properties中配置的ranger地址為http://...應該不會有這個問題，如果是https，則需要在策略同步時restClient中塞入用戶信息；具體代碼在RangerRestClient.java中，需要mUsername和mPassword分別有值，hive下：即是使用的hive用戶名及其keytab認證文件的地址作為mPassword

hive測試連接失敗

java通過keberos連接hive一般如下：

    String hiveUserName = "test_hive";//kerberos認證的用戶principal名稱
    String hiveKeytab = ".../xxxxx.keytab";//用戶的keytab認證文件
    String krbconf = ".../krb5.conf";//kerberos5的配置文件
 
    System.setProperty("java.security.krb5.conf", krbconf);
    Configuration conf = new Configuration();
    conf.set("hadoop.security.authentication", "Kerberos");
    UserGroupInformation.setConfiguration(conf);
    UserGroupInformation.loginUserFromKeytab(hiveUserName, hiveKeytab);

查閱ranger連接處理核心類：SecureClientLogin，其調用函數：

public synchronized static Subject loginUserFromKeytab(String user, String path, String nameRules) throws IOException {
        try {
            Subject subject = new Subject();
            SecureClientLoginConfiguration loginConf = new SecureClientLoginConfiguration(true, user, path);
            LoginContext login = new LoginContext("hadoop-keytab-kerberos", subject, null, loginConf);
            KerberosName.setRules(nameRules);
            subject.getPrincipals().add(new User(user, AuthenticationMethod.KERBEROS, login));
            login.logout();
            login.login();
            return login.getSubject();
        } catch (LoginException le) {
            throw new IOException("Login failure for " + user + " from keytab " + path, le);
        }
    }

如上ranger源碼可以看出并無krb.conf設置，因此在這里重載了這個login邏輯如下：

public synchronized static Subject loginUserFromKeytab(String user, String path, String nameRules, String krb5Conf) throws IOException {
        try {
            Subject subject = new Subject();
            SecureClientLoginConfiguration loginConf = new SecureClientLoginConfiguration(true, user, path);
            loginConf.setConfiguration(new ZKSignerSecretProvider.JaasConfiguration("Client", user, path));
            if (!StringUtil.isEmpty(krb5Conf)) {
                System.setProperty("java.security.krb5.conf", krb5Conf);
            }
            System.setProperty("zookeeper.server.principal", "zookeeper/hadoop");
            LoginContext login = new LoginContext("hadoop-keytab-kerberos", subject, null, loginConf);
            KerberosName.setRules(nameRules);
            subject.getPrincipals().add(new User(user, AuthenticationMethod.KERBEROS, login));
            login.logout();
            login.login();
            return login.getSubject();
        } catch (LoginException le) {
            throw new IOException("Login failure for " + user + " from keytab " + path, le);
        }
    }

調整BaseClient login調用出代碼：

 protected void login() {
...
    if(StringUtils.isEmpty(lookupPrincipal) || StringUtils.isEmpty(lookupKeytab)){
         if (userName == null) {
            throw createException("Unable to find login username for hadoop environment, [" + serviceName + "]", null);
         }
         String keyTabFile = configHolder.getKeyTabFile();
         if (keyTabFile != null) {
             if ( configHolder.isKerberosAuthentication() ) {
                 LOG.info("Init Login: security enabled, using username/keytab");

                 loginSubject = SecureClientLogin.loginUserFromKeytab(userName, keyTabFile, nameRules,
                                 connectionProperties.get("java.security.krb5.conf"));
                 }
                 else {
                     LOG.info("Init Login: using username");
                     loginSubject = SecureClientLogin.login(userName);
                     }
                 }
...

service連接界面配置：

testConnection.PNG

在keytabfile和java.security.krb5.conf中指定相關配置地址即可；