This talk will cover the topics of attribute-based access control (ABAC), Apache Ranger, and Apache Accumulo. Attribute-based access control (ABAC) is a relatively new standard from NIST that provides a flexible framework that replaces the complex matrix nightmare scenario of user/group/role mappings in enterprise role-based access control (RBAC) systems. ABAC provides the ability to manage and enforce authorizations for both person and non-person entities and makes policy decisions based on subject, action, resource, and environment attributes. Ranger and Accumulo are two technologies that, when combined, allow creation of systems that support ABAC at the cell-level. Ranger provides an extensible framework for distributed policy decision and enforcement with centralized administration as well as auditing authorization decisions within the Apache Hadoop ecosystem. Accumulo's pluggable security model enables the integration of Ranger providing GUI- and REST-driven authorization management, user and group synchronization with LDAP endpoints, and a centralized authorization audit repository. The combination of Ranger and Accumulo enables alignment with NIST ABAC standards for the Hadoop ecosystem. This talk will cover why that matters, the mechanics of Ranger's authorization model, and demonstrate an integration of the two systems. Speakers John Highcock, Systems Architect, Hortonworks Marcus Waineo, Principal Solutions Engineer, Hortonworks

1. 1 © Hortonworks Inc. 2011–2018. All rights reserved
Integration of Apache Accumulo and
Apache Ranger
Marcus Waineo, Principal Solutions Engineer
John Highcock, Systems Architect

2. 2 © Hortonworks Inc. 2011–2018. All rights reserved
Introduction
2
• Attribute Based Access Control (ABAC)
• Apache Ranger
• Apache Accumulo security
• Accumulo-Ranger integration Demo
• Future Work

3. 3 © Hortonworks Inc. 2011–2018. All rights reserved
What Is Attribute Based Access Control?
3
• An access control method where subject requests to perform operations on objects are
granted or denied based on assigned attributes of the subject, assigned attributes of the
object, environment conditions, and a set of policies that are specified in terms of those
attributes and conditions.
• Subject (person entity / non-person entity)
• Object (Resource)
• Attributes (of subject and object
• Policy
• Environment

4. 4 © Hortonworks Inc. 2011–2018. All rights reserved
Why Use ABAC?
4
• Consistent implementation of centralized policies, centralized object and attribute
management
• More flexible than legacy RBAC / ACL based systems and technologies
• Examples

5. 5 © Hortonworks Inc. 2011–2018. All rights reserved
What Is Apache Ranger?
5
• Created by XA Secure, acquired by Hortonworks and donated to Apache in 2014
• Distributed framework for management and monitoring of comprehensive data security
of the Hadoop ecosystem
• Provides centralized policy management and audit
• Provides distributed policy decision points and policy enforcement
• Already supports 10+ ecosystem components including
• HDFS
• YARN
• Nifi
• HiveServer 2
• etc.

6. 6 © Hortonworks Inc. 2011–2018. All rights reserved
HDFS
Ranger Administration Portal
HBase
Hive Server2
Ranger Audit Server
Ranger Plugin
HadoopComponentsEnterprise
Users
Ranger Plugin
Ranger Plugin
Legacy Tools and Data Governance
HDFS
Knox
NifI
Ranger Plugin
Ranger Plugin
SolrRanger Plugin
Ranger Policy Server
Integration API
KafkaRanger Plugin
YARNRanger Plugin
Ranger PluginStorm Ranger Plugin Accumulo
Solr
How Apache Ranger works

7. 7 © Hortonworks Inc. 2011–2018. All rights reserved
Why Use Apache Ranger with Accumulo?
7
• The only Hadoop ecosystem security project capable of supporting ABAC
• Provides security framework to allow users to more easily leverage Accumulo’s superior
security features
• Distributed plugin architecture maps well to Accumulo tabletserver architecture
• Centralized policy management and audit for Accumulo and other Hadoop ecosystem
services (e.g. HDFS)

8. 8 © Hortonworks Inc. 2011–2018. All rights reserved
How Accumulo Security Works
8
• Authentication
• Supports Kerberos
• Permissions
• Pertains to System, Table, and Namespace
• Authorizations
• Pertains to data within the system, implemented via Accumulo column visibilities

9. 9 © Hortonworks Inc. 2011–2018. All rights reserved
Accumulo-Ranger Integration Status
9
• Ranger Authorization and Auditing via User and/or Group Assignment for
• Table
• Namespace
• System
• Authorizations
• Created a few things
• Ranger Plugin for Accumulo
• Ambari blueprint for automated Kerberos/Ranger deployment
• Docker containers
• https://github.com/trucemop/rangerAccumulo

10. 10 © Hortonworks Inc. 2011–2018. All rights reserved
Demo

11. 11 © Hortonworks Inc. 2011–2018. All rights reserved
Demo Overview
11
• Simple example of a doctor’s office
• One table within a namespace (office.patient)
• Demo will use 2 users
• doctorbob
• tom, member of reception group
• Below able contains entries with labels for pii, phi, maskedpii, and maskedphi
Accumulo Authorizations
Accumulo Permissions
Namespace Table All
pii phi maskedpii maskedphi office office.patient
Users
doctorbob X X X
accumulo X
Groups
reception X X X
billing X X

12. 12 © Hortonworks Inc. 2011–2018. All rights reserved
Accumulo Permissions and Authorizations as Ranger Policies
12

13. 13 © Hortonworks Inc. 2011–2018. All rights reserved
Demo Script
13
• doctorbob scan order:
1. scan office.patient table with no auth
2. scan office.patient table with pii (explicitly granted to user doctorbob)
3. scan office.patient table with pii,phi (explicitly granted to user doctorbob)
4. scan office.patient table with pii,phi,nope (undefined accumulo authorization)
5. scan office.patient table with pii,phi,maskedpii (defined, but unauthorized)
• tom scan order
1. scan office.patient table with maskedpii,maskedphi (granted by tom's group membership)
2. scan office.patient table with maskedpii,maskedphi,pii (ungranted accumulo authornization)
3. scan trace table (namespace or table he does not have access to)
4. insert into office.patient (write on table)
5. scan office.patient table with maskedpii (scan to show new entries)

14. 14 © Hortonworks Inc. 2011–2018. All rights reserved
User “doctorbob” scans, pt1
14

15. 15 © Hortonworks Inc. 2011–2018. All rights reserved
User “doctorbob” scans, pt2
15

16. 16 © Hortonworks Inc. 2011–2018. All rights reserved
Audit events of “doctorbob” scans
16

17. 17 © Hortonworks Inc. 2011–2018. All rights reserved
User “tom” scans, pt1
17

18. 18 © Hortonworks Inc. 2011–2018. All rights reserved
User “tom” scans, pt2
18

19. 19 © Hortonworks Inc. 2011–2018. All rights reserved
Audit events of “tom” scans
19

20. 20 © Hortonworks Inc. 2011–2018. All rights reserved
Future Work
20
• Enable editing Ranger policies via Accumulo API
• Consolidation of audit events​
• RANGER-919
• Resource lookup for table/namespace
• LDAP attribute sync
• Apache Atlas Tag integration

21. 21 © Hortonworks Inc. 2011–2018. All rights reserved
Thank you