Big Data Security, Permissions, and Multi-Tenancy
Security layers
FusionInsight security separates authentication from authorization. Kerberos authenticates users and services with principals and keytabs; LDAP can provide directory-backed identities; TLS protects transport. Ranger enforces fine-grained policies for HDFS, Hive, HBase, Kafka, and YARN. HDFS ACLs and POSIX permissions still apply. Audit logs record access decisions. Multi-tenancy assigns tenants to resource queues and storage paths so tenants share a cluster without seeing each other's data.
Worked example
Tenant sales needs a Hive database, an HDFS home directory, a YARN queue, and Kafka topics prefixed sales-. In FusionInsight Manager, create the tenant and assign the queue and HDFS path; in Ranger, grant sales users SELECT on sales_db, read/write on /user/sales, and produce/consume on sales-*. Authentication alone does not grant any of these rights. HBase namespace ACLs may also be needed if the tenant uses HBase.
Traps that cost marks
Do not confuse a Kerberos ticket with an authorization policy. Do not rely on Linux file permissions for Hive tables; Ranger and the metastore govern access. Do not give a tenant the superuser role to fix a permission error. Service principals need keytabs renewed before expiry. A YARN queue ACL and a Ranger HDFS policy are separate controls.