Once the identity of the end user is established via Kerberos authentication, the next step in Hadoop security is to ensure what actions or services those established identities can perform. Authorization deals with that. In the following sections, we will look into how authorization rules can be established for different users across different services and how data is stored in HDFS. We will look into two different types of tools that facilitate centralized security policy management for authorization. Let's look into these in brief.
User authorization
Ranger
The following diagram represents the architecture of the Ranger tool, which lets you centrally manage security policies for different Hadoop services:
As shown...
