5 ms·
Thank you for the extra explanations. But I'm afraid I still don't understand. With Kerberos you have a single Id, yes but that is augmented by groups coming f
by lars_francke 9y ago
Thank you for the extra explanations. But I'm afraid I still don't understand.
With Kerberos you have a single Id, yes but that is augmented by groups coming from LDAP and RBAC systems like Sentry & Ranger.
Also having another system issuing certificates automatically is a no-go in lots of companies and especially security conscious industries.
I'm not saying that there's not a market for what you're developing - I'm merely trying to understand and I have a hard time. Your homepage, I'm afraid though, is useless at conveying any information about what you're actually doing.
- jamesblonde 9y agoSentry and Ranger offer RBAC, but not dynamic roles or attribute-based access control. Dynamic roles for us are: if you are a data scientist working on a dataset, when working on that dataset, we give you the minimum roles needed to work on that dataset. If you normally have privileges to write to some other directory outside that subtree in HDFS, we take it away while you are active in the project. When you change projects, your access rights change. Sentry and Ranger are horrendous. Best practice for them in HDFS is to change permissions for subtrees in Hive/Impala to '000' so that sysadmins know that an external system is doing access control here. They do not offer unified access control, rather fragmented access control. In our case, you see a different username in hdfs for each of your projects. I agree the homepage sucks - it's on our todo list :)
- jamesblonde 9y agoBtw, I gave the talk after you at the Dataworks Summit in Munich. Nice talk!