PH20398: RANGER PLUG IN FOR BIGSQL NOT PULLING IN RANGER HADOOP POLICIES IN PLACE

APAR status

• Closed as fixed if next.

Error description

• The Ranger Hadoop policy for the bigsql table has been
  restricted and the user has rwx on the directory.
  
  When a user tries to drop a table they see the following
  error:
  
  SQL Exception(s) Encountered:
  [State:
  4250][Code: -551]: The statement failed because the
  authorization ID does not have the required authorization or
  privilege to perform the operation. Authorization ID: "USER".
  Operation: "DROP TABLE". Object: "/analytics/shared/julie1"..
  SQLCODE=-551, SQLSTATE= 4250, DRIVER=3.72.46
  
  Once this fix is applied, you must set the hdfs.proxyuser.bigsql
  configuration properties so that bigsql can impersonate the
  connected user and perform the check against the Ranger HDFS
  plugin.  These are set in Ambari in HDFS Configs -> Advanced ->
  Custom core-site
  .
  hadoop.proxyuser.<bigsql>.groups
      The default value is *. Preferably, in order to be more
  restrictive, for this fix this property needs to include all
  those user groups that bigsql must impersonate to enable the
  Ranger HDFS check.
  .
  hadoop.proxyuser.<bigsql>.hosts
      The default value is *. Preferably, in order to be more
  restrictive, this property should be set to a comma-separated
  list of all Big SQL head nodes.
  .
  Until the fix is available, use the local fix documented below.
  

Local fix

• Manually set the permissions on the hdfs folder for the user to
  include execute (rwx)
  

Problem summary

• Please see problem description
  

Problem conclusion

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels