Getting Started

Overview

This guide prepares the Britive Access Broker to manage JIT access to Cloudera Data Platform (CDP) using the Apache Ranger Admin REST API. The broker creates a Ranger policy granting the requesting user access to the specified resource (HDFS path, Hive table, HBase table) at checkout and deletes it at checkin.

Before You Begin

A running Britive Access Broker on a Linux host with network access to:
- The Ranger Admin host (default port 6080)
curl and jq installed on the broker host
A Cloudera cluster with Apache Ranger as the authorization engine (included in CDP Public Cloud and CDP Private Cloud 7.x)
A Ranger service account with the Security Admin role in Ranger Admin
A broker pool token from Resource Manager → Broker Pools → New Pool in the Britive console

Apache Ranger is the authorization engine for Cloudera Data Platform. This integration uses the Ranger Admin REST API — it does not require Kerberos credentials on the broker host.

Step 1 — Create a Ranger Service Account

The broker authenticates to the Ranger Admin REST API with basic auth using a dedicated service account.

Open Ranger Admin

Create a user

Go to Settings → Users/Groups/Roles → Add New User. Create a user with a strong random password. Set the User Role to Admin.

Test the API

From the broker host, confirm connectivity:

curl -u "britive_svc:password" \
  "http://<ranger-host>:6080/service/public/v2/api/policy" \
  -H "Accept: application/json" | jq '.totalCount'

A numeric response confirms API access.

Store credentials

Save the service account password in the Britive Secrets Store or your secret manager. Reference it as an environment variable in the broker scripts — never hardcode it.

Step 2 — Identify the Ranger Service Name

Each Ranger-protected service (HDFS, Hive, HBase) has a service name in Ranger. You need this when creating policies.

# List all Ranger services — find the name for your service type
curl -u "britive_svc:password" \
  "http://<ranger-host>:6080/service/public/v2/api/service" \
  -H "Accept: application/json" | jq '.[].name'

Common service names follow the pattern <cm_cluster_name>_hdfs, <cm_cluster_name>_hive, <cm_cluster_name>_hbase.

Step 3 — Register the Cluster as a Resource

Create a resource type

In the Britive console, go to Resource Manager → Resource Types → New Resource Type. Name it ClouderaCDP.

Add parameters:

Parameter	Type	Required	Notes
`ranger_url`	string	Yes	Ranger Admin base URL, e.g. `http://ranger.internal:6080`
`ranger_service`	string	Yes	Ranger service name for the target component
`ranger_user`	string	Yes	Ranger service account username

Register the resource

Go to Resource Manager → Resources → New Resource. Select ClouderaCDP.

Set parameter values for your cluster:

Parameter	Value
`ranger_url`	`http://ranger.internal:6080`
`ranger_service`	`mycluster_hive`
`ranger_user`	`britive_svc`

Assign a broker pool

Under Broker Pools, select the pool whose broker can reach the Ranger Admin host.

Verify

Confirm the broker can query Ranger policies:

curl -u "britive_svc:password" \
  "http://ranger.internal:6080/service/public/v2/api/policy?serviceName=mycluster_hive" \
  -H "Accept: application/json" | jq '.totalCount'

Troubleshoot

Symptom	Cause	Fix
`HTTP 401`	Wrong credentials or account locked	Reset the service account password in Ranger Admin
`HTTP 403`	Service account lacks Admin role	Edit the user in Settings → Users and set User Role to Admin
`Connection refused`	Wrong Ranger host or port	Verify `ranger_url` — default is port 6080 for HTTP, 6182 for HTTPS
`curl: command not found`	`curl` not installed on broker	`sudo apt-get install curl` or `sudo dnf install curl`
Policy count is 0	Connected to wrong service	Verify `ranger_service` name matches the Ranger service for your component

Last updated on May 6, 2026

Ranger Policy Access