You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ranger.apache.org by ma...@apache.org on 2026/09/08 05:46:37 UTC
(ranger) branch ranger-2.10 updated (6901c5494 -> e6245f5b6)
This is an automated email from the ASF dual-hosted git repository.
mneethiraj pushed a change to branch ranger-2.10
in repository https://gitbox.apache.org/repos/asf/ranger.git
from 6901c5494 RANGER-5753: LDAP/Active Directory authentication does not validate local Ranger account status (backport) (#1202)
new 232671ed1 RANGER-5788: blogs: update to use styles from a common css (#1215)
new e6245f5b6 RANGER-5788: blogs: fix incorrect rendering of blog contents
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
docs/pom.xml | 8 +
.../site/resources/blogs/adventures_in_abac_1.html | 437 -----------
.../site/resources/blogs/adventures_in_abac_2.html | 312 --------
docs/src/site/resources/blogs/blog.css | 514 +++++++++++++
.../site/resources/blogs/dynamic_expressions.html | 668 -----------------
.../resources/blogs/integrating_applications.html | 828 ---------------------
docs/src/site/resources/blogs/policy_model.html | 634 ----------------
.../resources/css/bootstrap-responsive.min.css | 20 +
docs/src/site/resources/css/bootstrap.min.css | 9 +
docs/src/site/resources/css/custom.css | 2 +-
docs/src/site/resources/js/bootstrap.min.js | 7 +
docs/src/site/resources/js/html5.js | 4 +
docs/src/site/resources/js/jquery.min.js | 5 +
docs/src/site/site.xml | 9 +-
docs/src/site/xdoc/blogs.xml | 85 +--
docs/src/site/xdoc/blogs/adventures_in_abac_1.xml | 205 +++++
docs/src/site/xdoc/blogs/adventures_in_abac_2.xml | 180 +++++
docs/src/site/xdoc/blogs/dynamic_expressions.xml | 566 ++++++++++++++
.../site/xdoc/blogs/integrating_applications.xml | 440 +++++++++++
docs/src/site/xdoc/blogs/policy_model.xml | 526 +++++++++++++
20 files changed, 2528 insertions(+), 2931 deletions(-)
delete mode 100644 docs/src/site/resources/blogs/adventures_in_abac_1.html
delete mode 100644 docs/src/site/resources/blogs/adventures_in_abac_2.html
create mode 100644 docs/src/site/resources/blogs/blog.css
delete mode 100644 docs/src/site/resources/blogs/dynamic_expressions.html
delete mode 100644 docs/src/site/resources/blogs/integrating_applications.html
delete mode 100644 docs/src/site/resources/blogs/policy_model.html
create mode 100644 docs/src/site/resources/css/bootstrap-responsive.min.css
create mode 100644 docs/src/site/resources/css/bootstrap.min.css
create mode 100644 docs/src/site/resources/js/bootstrap.min.js
create mode 100644 docs/src/site/resources/js/html5.js
create mode 100644 docs/src/site/resources/js/jquery.min.js
create mode 100644 docs/src/site/xdoc/blogs/adventures_in_abac_1.xml
create mode 100644 docs/src/site/xdoc/blogs/adventures_in_abac_2.xml
create mode 100644 docs/src/site/xdoc/blogs/dynamic_expressions.xml
create mode 100644 docs/src/site/xdoc/blogs/integrating_applications.xml
create mode 100644 docs/src/site/xdoc/blogs/policy_model.xml
(ranger) 02/02: RANGER-5788: blogs: fix incorrect rendering of blog contents
Posted by ma...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
mneethiraj pushed a commit to branch ranger-2.10
in repository https://gitbox.apache.org/repos/asf/ranger.git
commit e6245f5b63adc414972f9caa923c7a86d4ebb789
Author: Madhan Neethiraj <ma...@apache.org>
AuthorDate: Mon Sep 7 22:39:33 2026 -0700
RANGER-5788: blogs: fix incorrect rendering of blog contents
(cherry picked from commit bd456e40fd4d4771a0687d9a6476b8a963c2d30a)
---
docs/src/site/resources/blogs/blog.css | 40 ++++++++++++----------
.../resources/css/bootstrap-responsive.min.css | 20 +++++++++++
docs/src/site/resources/css/bootstrap.min.css | 9 +++++
docs/src/site/resources/css/custom.css | 1 -
docs/src/site/resources/js/bootstrap.min.js | 7 ++++
docs/src/site/resources/js/html5.js | 4 +++
docs/src/site/resources/js/jquery.min.js | 5 +++
docs/src/site/site.xml | 9 ++---
docs/src/site/xdoc/blogs/adventures_in_abac_1.xml | 3 --
docs/src/site/xdoc/blogs/adventures_in_abac_2.xml | 3 --
docs/src/site/xdoc/blogs/dynamic_expressions.xml | 3 --
.../site/xdoc/blogs/integrating_applications.xml | 3 --
docs/src/site/xdoc/blogs/policy_model.xml | 3 --
13 files changed, 71 insertions(+), 39 deletions(-)
diff --git a/docs/src/site/resources/blogs/blog.css b/docs/src/site/resources/blogs/blog.css
index 4c79e0ccc..993c52fc9 100644
--- a/docs/src/site/resources/blogs/blog.css
+++ b/docs/src/site/resources/blogs/blog.css
@@ -32,29 +32,31 @@
--blog-max-width: 46rem;
}
-@media (prefers-color-scheme: dark) {
- :root {
- --blog-bg: #0f1419;
- --blog-surface: #1a2332;
- --blog-text: #e2e8f0;
- --blog-muted: #94a3b8;
- --blog-heading: #f8fafc;
- --blog-accent: #5fffd7;
- --blog-accent-hover: #7bffe0;
- --blog-border: #334155;
- --blog-code-bg: #0f172a;
- --blog-table-bg: #243044;
- --blog-table-header-bg: #2f3f56;
- --blog-table-border: #64748b;
- --blog-table-stripe: #1f2d40;
- }
-}
-
*, *::before, *::after {
box-sizing: border-box;
}
-/* Blog posts rendered inside the Maven site skin */
+/* Match the light Ranger site skin regardless of OS dark-mode preference */
+.project-ranger .ranger-blog-post,
+.project-ranger .ranger-blog-index,
+.project-ranger .body-content .section:has(> .ranger-blog-post) > h2 {
+ color: #1e293b;
+}
+
+.project-ranger .ranger-blog__body h1,
+.project-ranger .ranger-blog__body h2,
+.project-ranger .ranger-blog__body h3,
+.project-ranger .body-content .section:has(> .ranger-blog-post) > h2 {
+ color: #0f172a;
+}
+
+.project-ranger .ranger-blog-post p,
+.project-ranger .ranger-blog-post li,
+.project-ranger .ranger-blog-post td,
+.project-ranger .ranger-blog-post th {
+ color: #1e293b;
+}
+
.ranger-blog-post {
max-width: var(--blog-max-width);
margin: 0 auto;
diff --git a/docs/src/site/resources/css/bootstrap-responsive.min.css b/docs/src/site/resources/css/bootstrap-responsive.min.css
new file mode 100644
index 000000000..291c98f54
--- /dev/null
+++ b/docs/src/site/resources/css/bootstrap-responsive.min.css
@@ -0,0 +1,20 @@
+/*!
+ * Bootstrap Responsive v2.3.1
+ *
+ * Copyright 2012 Twitter, Inc
+ * Licensed under the Apache License v2.0
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Designed and built with all the love in the world @twitter by @mdo and @fat.
+ */
+.clearfix{*zoom:1;}.clearfix:before,.clearfix:after{display:table;content:"";line-height:0;}
+.clearfix:after{clear:both;}
+.hide-text{font:0/0 a;color:transparent;text-shadow:none;background-color:transparent;border:0;}
+.input-block-level{display:block;width:100%;min-height:30px;-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box;}
+@-ms-viewport{width:device-width;}.hidden{display:none;visibility:hidden;}
+.visible-phone{display:none !important;}
+.visible-tablet{display:none !important;}
+.hidden-desktop{display:none !important;}
+.visible-desktop{display:inherit !important;}
+@media (min-width:768px) and (max-width:979px){.hidden-desktop{display:inherit !important;} .visible-desktop{display:none !important ;} .visible-tablet{display:inherit !important;} .hidden-tablet{display:none !important;}}@media (max-width:767px){.hidden-desktop{display:inherit !important;} .visible-desktop{display:none !important;} .visible-phone{display:inherit !important;} .hidden-phone{display:none !important;}}.visible-print{display:none !important;}
+@media print{.visible-print{display:inherit !important;} .hidden-print{display:none !important;}}@media (max-width:767px){body{padding-left:20px;padding-right:20px;} .navbar-fixed-top,.navbar-fixed-bottom,.navbar-static-top{margin-left:-20px;margin-right:-20px;} .container-fluid{padding:0;} .dl-horizontal dt{float:none;clear:none;width:auto;text-align:left;} .dl-horizontal dd{margin-left:0;} .container{width:auto;} .row-fluid{width:100%;} .row,.thumbnails{margin-left:0;} .thumbnails>li{f [...]
diff --git a/docs/src/site/resources/css/bootstrap.min.css b/docs/src/site/resources/css/bootstrap.min.css
new file mode 100644
index 000000000..3ba9f47d1
--- /dev/null
+++ b/docs/src/site/resources/css/bootstrap.min.css
@@ -0,0 +1,9 @@
+@import url("//fonts.googleapis.com/css?family=Lato:400,700,900,400italic");/*!
+ * Bootstrap v2.3.2
+ *
+ * Copyright 2012 Twitter, Inc
+ * Licensed under the Apache License v2.0
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Designed and built with all the love in the world @twitter by @mdo and @fat.
+ */.clearfix{*zoom:1}.clearfix:before,.clearfix:after{display:table;line-height:0;content:""}.clearfix:after{clear:both}.hide-text{font:0/0 a;color:transparent;text-shadow:none;background-color:transparent;border:0}.input-block-level{display:block;width:100%;min-height:31px;-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}article,aside,details,figcaption,figure,footer,header,hgroup,nav,section{display:block}audio,canvas,video{display:inline-block;*display:in [...]
diff --git a/docs/src/site/resources/css/custom.css b/docs/src/site/resources/css/custom.css
index 4be44c1b4..62d1c9daa 100644
--- a/docs/src/site/resources/css/custom.css
+++ b/docs/src/site/resources/css/custom.css
@@ -1,5 +1,4 @@
/* You can override this file with your own styles */
-@import url('https://fonts.googleapis.com/css2?family=Raleway:wght@300;400;600&family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;1,300;1,400&display=swap');
@import url('../blogs/blog.css');
.project-ranger{
diff --git a/docs/src/site/resources/js/bootstrap.min.js b/docs/src/site/resources/js/bootstrap.min.js
new file mode 100644
index 000000000..319a85dfd
--- /dev/null
+++ b/docs/src/site/resources/js/bootstrap.min.js
@@ -0,0 +1,7 @@
+/**
+* Bootstrap.js by @fat & @mdo
+* plugins: bootstrap-transition.js, bootstrap-modal.js, bootstrap-dropdown.js, bootstrap-scrollspy.js, bootstrap-tab.js, bootstrap-tooltip.js, bootstrap-popover.js, bootstrap-affix.js, bootstrap-alert.js, bootstrap-button.js, bootstrap-collapse.js, bootstrap-carousel.js, bootstrap-typeahead.js
+* Copyright 2012 Twitter, Inc.
+* http://www.apache.org/licenses/LICENSE-2.0.txt
+*/
+!function(a){a(function(){a.support.transition=function(){var a=function(){var a=document.createElement("bootstrap"),b={WebkitTransition:"webkitTransitionEnd",MozTransition:"transitionend",OTransition:"oTransitionEnd otransitionend",transition:"transitionend"},c;for(c in b)if(a.style[c]!==undefined)return b[c]}();return a&&{end:a}}()})}(window.jQuery),!function(a){var b=function(b,c){this.options=c,this.$element=a(b).delegate('[data-dismiss="modal"]',"click.dismiss.modal",a.proxy(this.hi [...]
\ No newline at end of file
diff --git a/docs/src/site/resources/js/html5.js b/docs/src/site/resources/js/html5.js
new file mode 100644
index 000000000..355afd106
--- /dev/null
+++ b/docs/src/site/resources/js/html5.js
@@ -0,0 +1,4 @@
+/**
+* @preserve HTML5 Shiv 3.7.3 | @afarkas @jdalton @jon_neal @rem | MIT/GPL2 Licensed
+*/
+!function(a,b){function c(a,b){var c=a.createElement("p"),d=a.getElementsByTagName("head")[0]||a.documentElement;return c.innerHTML="x<style>"+b+"</style>",d.insertBefore(c.lastChild,d.firstChild)}function d(){var a=t.elements;return"string"==typeof a?a.split(" "):a}function e(a,b){var c=t.elements;"string"!=typeof c&&(c=c.join(" ")),"string"!=typeof a&&(a=a.join(" ")),t.elements=c+" "+a,j(b)}function f(a){var b=s[a[q]];return b||(b={},r++,a[q]=r,s[r]=b),b}function g(a,c,d){if(c||(c=b),l [...]
\ No newline at end of file
diff --git a/docs/src/site/resources/js/jquery.min.js b/docs/src/site/resources/js/jquery.min.js
new file mode 100644
index 000000000..006e95310
--- /dev/null
+++ b/docs/src/site/resources/js/jquery.min.js
@@ -0,0 +1,5 @@
+/*! jQuery v1.9.1 | (c) 2005, 2012 jQuery Foundation, Inc. | jquery.org/license
+//@ sourceMappingURL=jquery.min.map
+*/(function(e,t){var n,r,i=typeof t,o=e.document,a=e.location,s=e.jQuery,u=e.$,l={},c=[],p="1.9.1",f=c.concat,d=c.push,h=c.slice,g=c.indexOf,m=l.toString,y=l.hasOwnProperty,v=p.trim,b=function(e,t){return new b.fn.init(e,t,r)},x=/[+-]?(?:\d*\.|)\d+(?:[eE][+-]?\d+|)/.source,w=/\S+/g,T=/^[\s\uFEFF\xA0]+|[\s\uFEFF\xA0]+$/g,N=/^(?:(<[\w\W]+>)[^>]*|#([\w-]*))$/,C=/^<(\w+)\s*\/?>(?:<\/\1>|)$/,k=/^[\],:{}\s]*$/,E=/(?:^|:|,)(?:\s*\[)+/g,S=/\\(?:["\\\/bfnrt]|u[\da-fA-F]{4})/g,A=/"[^"\\\r\n]*"|tru [...]
+return(!i||i!==r&&!b.contains(r,i))&&(e.type=o.origType,n=o.handler.apply(this,arguments),e.type=t),n}}}),b.support.submitBubbles||(b.event.special.submit={setup:function(){return b.nodeName(this,"form")?!1:(b.event.add(this,"click._submit keypress._submit",function(e){var n=e.target,r=b.nodeName(n,"input")||b.nodeName(n,"button")?n.form:t;r&&!b._data(r,"submitBubbles")&&(b.event.add(r,"submit._submit",function(e){e._submit_bubble=!0}),b._data(r,"submitBubbles",!0))}),t)},postDispatch:fu [...]
+}b.merge(d,s.childNodes),s.textContent="";while(s.firstChild)s.removeChild(s.firstChild);s=f.lastChild}else d.push(t.createTextNode(o));s&&f.removeChild(s),b.support.appendChecked||b.grep(Ot(d,"input"),Bt),h=0;while(o=d[h++])if((!r||-1===b.inArray(o,r))&&(a=b.contains(o.ownerDocument,o),s=Ot(f.appendChild(o),"script"),a&&Mt(s),n)){i=0;while(o=s[i++])kt.test(o.type||"")&&n.push(o)}return s=null,f},cleanData:function(e,t){var n,r,o,a,s=0,u=b.expando,l=b.cache,p=b.support.deleteExpando,f=b. [...]
\ No newline at end of file
diff --git a/docs/src/site/site.xml b/docs/src/site/site.xml
index 40d90dffe..d4cfd8ac1 100644
--- a/docs/src/site/site.xml
+++ b/docs/src/site/site.xml
@@ -44,7 +44,7 @@ under the License.
<body>
<head>
<![CDATA[
- <link href="css/custom.css" rel="stylesheet"/>
+ <link href="/css/custom.css" rel="stylesheet"/>
]]>
</head>
<menu name="Overview">
@@ -128,11 +128,12 @@ under the License.
<custom>
<reflowSkin>
<theme>bootswatch-flatly</theme>
+ <localResources>true</localResources>
<highlightJs>true</highlightJs>
<brand>
<name>
<![CDATA[
- <img src="ranger-logo.svg" alt="Apache Ranger" width=250px; height=100px;>
+ <img src="/ranger-logo.svg" alt="Apache Ranger" width=250px; height=100px;>
]]>
</name>
<href>https://ranger.apache.org</href>
@@ -153,8 +154,8 @@ under the License.
</bottomDescription>
<skipGenerationDate>true</skipGenerationDate>
<endContent>
- <script src="override-banner.js"></script>
- <script src="smooth-scroll.js"></script>
+ <script src="/override-banner.js"></script>
+ <script src="/smooth-scroll.js"></script>
</endContent>
</reflowSkin>
</custom>
diff --git a/docs/src/site/xdoc/blogs/adventures_in_abac_1.xml b/docs/src/site/xdoc/blogs/adventures_in_abac_1.xml
index a163744fb..9cef64be2 100644
--- a/docs/src/site/xdoc/blogs/adventures_in_abac_1.xml
+++ b/docs/src/site/xdoc/blogs/adventures_in_abac_1.xml
@@ -16,9 +16,6 @@
limitations under the License.
-->
<document>
- <head>
- <link href="../css/custom.css" rel="stylesheet"/>
- </head>
<body>
<section name="Adventures in attribute-based access control (ABAC) - Part 1">
<div class="ranger-blog-post">
diff --git a/docs/src/site/xdoc/blogs/adventures_in_abac_2.xml b/docs/src/site/xdoc/blogs/adventures_in_abac_2.xml
index d5ed0a30f..aab3d41ca 100644
--- a/docs/src/site/xdoc/blogs/adventures_in_abac_2.xml
+++ b/docs/src/site/xdoc/blogs/adventures_in_abac_2.xml
@@ -16,9 +16,6 @@
limitations under the License.
-->
<document>
- <head>
- <link href="../css/custom.css" rel="stylesheet"/>
- </head>
<body>
<section name="Adventures in attribute-based access control (ABAC) - Part 2">
<div class="ranger-blog-post">
diff --git a/docs/src/site/xdoc/blogs/dynamic_expressions.xml b/docs/src/site/xdoc/blogs/dynamic_expressions.xml
index 900a4c0ad..6cf94f5c3 100644
--- a/docs/src/site/xdoc/blogs/dynamic_expressions.xml
+++ b/docs/src/site/xdoc/blogs/dynamic_expressions.xml
@@ -16,9 +16,6 @@
limitations under the License.
-->
<document>
- <head>
- <link href="../css/custom.css" rel="stylesheet"/>
- </head>
<body>
<section name="Apache Ranger - Dynamic Expressions">
<div class="ranger-blog-post">
diff --git a/docs/src/site/xdoc/blogs/integrating_applications.xml b/docs/src/site/xdoc/blogs/integrating_applications.xml
index d87baf7d4..63c681f91 100644
--- a/docs/src/site/xdoc/blogs/integrating_applications.xml
+++ b/docs/src/site/xdoc/blogs/integrating_applications.xml
@@ -16,9 +16,6 @@
limitations under the License.
-->
<document>
- <head>
- <link href="../css/custom.css" rel="stylesheet"/>
- </head>
<body>
<section name="Integrating Applications with Apache Ranger">
<div class="ranger-blog-post">
diff --git a/docs/src/site/xdoc/blogs/policy_model.xml b/docs/src/site/xdoc/blogs/policy_model.xml
index 362e1c238..1d7b16bc0 100644
--- a/docs/src/site/xdoc/blogs/policy_model.xml
+++ b/docs/src/site/xdoc/blogs/policy_model.xml
@@ -16,9 +16,6 @@
limitations under the License.
-->
<document>
- <head>
- <link href="../css/custom.css" rel="stylesheet"/>
- </head>
<body>
<section name="Apache Ranger Policy Model">
<div class="ranger-blog-post">
(ranger) 01/02: RANGER-5788: blogs: update to use styles from a common css (#1215)
Posted by ma...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
mneethiraj pushed a commit to branch ranger-2.10
in repository https://gitbox.apache.org/repos/asf/ranger.git
commit 232671ed187adf30584fd6a5b525ae25f245aabf
Author: Madhan Neethiraj <ma...@apache.org>
AuthorDate: Mon Sep 7 22:02:28 2026 -0700
RANGER-5788: blogs: update to use styles from a common css (#1215)
(cherry picked from commit ac36706b4ac5a82c7357137574a353cf7d5693b3)
---
docs/pom.xml | 8 +
.../site/resources/blogs/adventures_in_abac_1.html | 437 -----------
.../site/resources/blogs/adventures_in_abac_2.html | 312 --------
docs/src/site/resources/blogs/blog.css | 512 +++++++++++++
.../site/resources/blogs/dynamic_expressions.html | 668 -----------------
.../resources/blogs/integrating_applications.html | 828 ---------------------
docs/src/site/resources/blogs/policy_model.html | 634 ----------------
docs/src/site/resources/css/custom.css | 1 +
docs/src/site/xdoc/blogs.xml | 85 +--
docs/src/site/xdoc/blogs/adventures_in_abac_1.xml | 208 ++++++
docs/src/site/xdoc/blogs/adventures_in_abac_2.xml | 183 +++++
docs/src/site/xdoc/blogs/dynamic_expressions.xml | 569 ++++++++++++++
.../site/xdoc/blogs/integrating_applications.xml | 443 +++++++++++
docs/src/site/xdoc/blogs/policy_model.xml | 529 +++++++++++++
14 files changed, 2491 insertions(+), 2926 deletions(-)
diff --git a/docs/pom.xml b/docs/pom.xml
index d5ca8add7..e473ca8e6 100644
--- a/docs/pom.xml
+++ b/docs/pom.xml
@@ -19,6 +19,14 @@
<properties>
<project.build.sourceEncoding>ISO-8859-1</project.build.sourceEncoding>
<project.reporting.outputEncoding>ISO-8859-1</project.reporting.outputEncoding>
+ <javac.source.version>17</javac.source.version>
+ <javac.target.version>17</javac.target.version>
+ <maven-compiler-plugin.version>3.8.1</maven-compiler-plugin.version>
+ <maven-project-info-reports-plugin.version>2.4</maven-project-info-reports-plugin.version>
+ <maven-resources-plugin.version>3.2.0</maven-resources-plugin.version>
+ <maven-site-plugin.version>3.7</maven-site-plugin.version>
+ <!-- maven-site-plugin 3.7 requires Velocity 1.x for the reflow skin -->
+ <velocity.version>1.7</velocity.version>
</properties>
<name>Apache Ranger</name>
<description>
diff --git a/docs/src/site/resources/blogs/adventures_in_abac_1.html b/docs/src/site/resources/blogs/adventures_in_abac_1.html
deleted file mode 100644
index d43fbf5e0..000000000
--- a/docs/src/site/resources/blogs/adventures_in_abac_1.html
+++ /dev/null
@@ -1,437 +0,0 @@
-<!--
- Licensed to the Apache Software Foundation (ASF) under one or more
- contributor license agreements. See the NOTICE file distributed with
- this work for additional information regarding copyright ownership.
- The ASF licenses this file to You under the Apache License, Version 2.0
- (the "License"); you may not use this file except in compliance with
- the License. You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
--->
-<!DOCTYPE html>
-<html lang="en">
-
- <head>
- <meta http-equiv=Content-Type content="text/html; charset=utf-8">
- <title>Adventures in ABAC - Part 1</title>
- <style>
- <!--
- /* Font Definitions */
- @font-face {font-family:Wingdings; panose-1:5 0 0 0 0 0 0 0 0 0;}
- @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;}
- @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;}
- @font-face {font-family:"Calibri Light"; panose-1:2 15 3 2 2 2 4 3 2 4;}
-
- /* Style Definitions */
- p.MsoNormal, li.MsoNormal, div.MsoNormal
- {margin:0in; font-size:12.0pt; font-family:"Calibri",sans-serif;}
- h1
- {mso-style-link:"Heading 1 Char"; margin-top:12.0pt; margin-right:0in; margin-bottom:0in; margin-left:0in; page-break-after:avoid; font-size:16.0pt; font-family:"Calibri Light",sans-serif; color:#2F5496; font-weight:normal;}
-
- p.MsoFootnoteText, li.MsoFootnoteText, div.MsoFootnoteText
- {mso-style-link:"Footnote Text Char"; margin:0in; font-size:10.0pt; font-family:"Calibri",sans-serif;}
-
- p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
- {margin-top:0in; margin-right:0in; margin-bottom:0in; margin-left:.5in; font-size:12.0pt; font-family:"Calibri",sans-serif;}
- p.MsoListParagraphCxSpFirst, li.MsoListParagraphCxSpFirst, div.MsoListParagraphCxSpFirst
- {margin-top:0in; margin-right:0in; margin-bottom:0in; margin-left:.5in; font-size:12.0pt; font-family:"Calibri",sans-serif;}
- p.MsoListParagraphCxSpMiddle, li.MsoListParagraphCxSpMiddle, div.MsoListParagraphCxSpMiddle
- {margin-top:0in; margin-right:0in; margin-bottom:0in; margin-left:.5in; font-size:12.0pt; font-family:"Calibri",sans-serif;}
- p.MsoListParagraphCxSpLast, li.MsoListParagraphCxSpLast, div.MsoListParagraphCxSpLast
- {margin-top:0in; margin-right:0in; margin-bottom:0in; margin-left:.5in; font-size:12.0pt; font-family:"Calibri",sans-serif;}
- span.Heading1Char
- {mso-style-name:"Heading 1 Char"; mso-style-link:"Heading 1"; font-family:"Calibri Light",sans-serif; color:#2F5496;}
- span.FootnoteTextChar
- {mso-style-name:"Footnote Text Char"; mso-style-link:"Footnote Text";}
- .MsoChpDefault
- {font-family:"Calibri",sans-serif;}
-
- /* Page Definitions */
- @page WordSection1
- {size:8.5in 11.0in; margin:1.0in 1.0in 1.0in 1.0in;}
- div.WordSection1
- {page:WordSection1;}
-
-
- /* List Definitions */
- ol
- {margin-bottom:0in;}
- ul
- {margin-bottom:0in;}
- -->
- </style>
- </head>
-
- <body lang=EN-US style='width:800px;word-wrap:break-word;align:center;margin:auto;border:ridge' >
- <div style="margin-left:10pt;margin-right:10pt">
- <h1 style="text-align:center">Adventures in attribute-based access control (ABAC) - Part 1</h1>
- <p class=MsoNormal style='font:5.0pt "Times New Roman"'> </p>
- <div style="text-align:center">
- <p class=MsoNormal>Barbara Eckman, Ph.D., Distinguished Architect, Comcast</p>
- <p class=MsoNormal>Apr 29, 2023</p>
- </div>
- <p class=MsoNormal> </p>
-
- <div class=WordSection>
- <h1>Introduction</h1>
-
- <p class=MsoNormal>
- Simply put, data access control enforces constraints on who is permitted to access the data. An access control policy
- specifies 1) which data may be accessed by 2) which users and optionally 3) for how long
- <a href="#_ftn1" name="_ftnref1" title=""><span style='font-size:12.0pt;font-family:"Calibri",sans-serif'>[1]</span></a>.
- </p>
-
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal>Data can be specified in access control policies in multiple ways:</p>
-
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'>1.<span style='font:7.0pt "Times New Roman"'> </span>Resource-based access control: data is specified by its logical identifier e.g., table name, column name, Kafka topic name, AWS S3 bucket name.</p>
-
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>2.<span style='font:7.0pt "Times New Roman"'> </span>Tag-based access control (TBAC): data is specified by one or more of its properties, represented by a tag on its metadata, e.g., a Sales Region or Sensitivity Level.</p>
-
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>3.<span style='font:7.0pt "Times New Roman"'> </span>Row access control: specifies rows/records that are visible to the user at run time by setting up filters based on the value of an attribute, e.g., Sales Region is "US”.</p>
-
- <p class=MsoListParagraphCxSpLast style='text-indent:-.25in'>4.<span style='font:7.0pt "Times New Roman"'> </span>Masking access control: specifies if the data should be masked before making it available the user.
- <a href="#_ftn2" name="_ftnref2" title=""><span style='font-size:12.0pt;font-family:"Calibri",sans-serif'>[2]</span></a>
- </p>
-
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal>Users can be specified in access control policies in multiple ways:</p>
-
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'>1.<span style='font:7.0pt "Times New Roman"'> </span>by their individual IDs, or by their group IDs.</p>
-
- <p class=MsoListParagraphCxSpLast style='text-indent:-.25in'>2.<span style='font:7.0pt "Times New Roman"'> </span>by the roles the users belong to e.g., "USSalesPerson”. This approach is generally called Role-Based Access Control (RBAC).</p>
-
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal>It’s generally acknowledged that RBAC and TBAC are more maintainable, easier to understand, and therefore less error-prone than resource-based access control and identifying users by their IDs or group IDs. However, these are not sufficient for even moderately complex access control constraints, as we will see.</p>
-
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal>In this blog, we will consider various access control approaches for the following users in specified regions, having access to a given level of sensitive data. Users with access to Highly Sensitive data may also access Sensitive data.</p>
-
- <p class=MsoNormal> </p>
-
- <table class=MsoTableGrid border=1 cellspacing=0 cellpadding=0 style='margin-left:30.35pt;border-collapse:collapse;border:none'>
- <tr>
- <td width=90 valign=top style='width:67.25pt;border:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;text-align:center'><p class=MsoNormal><b>User</b></p></td>
- <td width=102 valign=top style='width:76.5pt;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt;text-align:center'><p class=MsoNormal><b>Region</b></p></td>
- <td width=132 valign=top style='width:99.0pt;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt;text-align:center'><p class=MsoNormal><b>Access Level</b></p></td>
- </tr>
- <tr>
- <td width=90 valign=top style='width:67.25pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Bob</p></td>
- <td width=102 valign=top style='width:76.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>US</p></td>
- <td width=132 valign=top style='width:99.0pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Highly Sensitive</p></td>
- </tr>
- <tr>
- <td width=90 valign=top style='width:67.25pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Celestine</p></td>
- <td width=102 valign=top style='width:76.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>EMEA</p></td>
- <td width=132 valign=top style='width:99.0pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Sensitive</p></td>
- </tr>
- </table>
-
- <p class=MsoNormal><span style='font-size:16.0pt;font-family:"Calibri Light",sans-serif;color:#2F5496'> </span></p>
-
- <h1>Resource and Identity-based Access Control: USSales</h1>
- <p class=MsoNormal>Consider the following table containing data from the US sales region.</p>
- <p class=MsoNormal align=center style='text-align:center'>
- <img width=700 height=140 id="Picture 6" src="adventures_in_abac_1.files/table_ussales.jpg" alt="Table USSales">
- </p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Resource and identity-based access-control policies might include:</p>
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>Allow Bob to access all columns because he’s from the US and has access to Highly Sensitive data.</p>
- <p class=MsoListParagraphCxSpLast style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>Deny access to Celestine on the table because she’s from EMEA, i.e., not from US.</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal align=center style='text-align:center'>
- <img width=700 height=800 border=1 id="policy_table_ussales_rib" src="adventures_in_abac_1.files/fig01-policy_ussales_rib.jpg" alt="Fig 1. Apache Ranger™ resource and identity-based access policy for table USSales">
- </p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal align=center style='text-align:center'>Fig 1. Apache Ranger™ resource and identity-based access policy for table USSales</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>This isn’t too onerous with two users, one table, and two Sales Regions.</p>
-
- <p class=MsoNormal><span style='font-size:16.0pt;font-family:"Calibri Light",sans-serif;color:#2F5496'> </span></p>
-
- <h1>Resource and Identity-based Access Control: GlobalSales</h1>
- <p class=MsoNormal>Let’s add a bit of complexity. Consider the following table containing data from several sales regions, including US and EMEA.</p>
- <p class=MsoNormal align=center style='text-align:center'>
- <img width=780 height=180 id="Picture 7" src="adventures_in_abac_1.files/table_globalsales.jpg" alt="Table: GlobalSales">
- </p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Resource-based and identity-based access-control policy might include:</p>
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>Allow Bob to access all columns in rows having salesRegion=US because he’s from the US and has access to Highly Sensitive data.</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>Allow Celestine to access columns c1-c10 in rows having salesRegion=EMEA because she’s from EMEA and has access to Sensitive data.</p>
- <p class=MsoListParagraphCxSpLast style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>Deny users from non-matching regions any access to the table.</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal align=center style='text-align:center'>
- <img width=700 height=800 border=1 id="Picture 9" src="adventures_in_abac_1.files/fig02-policy_globalsales_highly_sensitive.jpg" alt="Fig 2. Apache Ranger™ access policy for highly sensitive data in table GlobalSales">
- </p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal align=center style='text-align:center'>Fig 2. Apache Ranger™ access policy for highly sensitive data in table GlobalSales</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal align=center style='text-align:center'>
- <img width=700 height=800 border=1 id="Picture 14" src="adventures_in_abac_1.files/fig03-policy_globalsales_sensitive.jpg" alt="Fig 3. Apache Ranger™ access policy for sensitive data in table GlobalSales">
- </p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal align=center style='text-align:center'>Fig 3. Apache Ranger™ access policy for sensitive data in table GlobalSales</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal align=center style='text-align:center'>
- <img width=700 height=800 border=1 id="Picture 22" src="adventures_in_abac_1.files/fig04-policy_globalsales_non_sensitive.jpg" alt="Fig 4. Apache Ranger™ access policy for non-sensitive data in table GlobalSales">
- </p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal align=center style='text-align:center'>Fig 4. Apache Ranger™ access policy for non-sensitive data in table GlobalSales</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal align=center style='text-align:center'>
- <img width=700 height=800 border=1 id="Picture 16" src="adventures_in_abac_1.files/fig05-policy_globalsales_row_filter_sales_region.jpg" alt="Fig 5. Apache Ranger™ row-filter policy to restrict access to data in table GlobalSales based on sales region">
- </p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal align=center style='text-align:center'>Fig 5. Apache Ranger™ row-filter policy to restrict access to data in table GlobalSales based on sales region</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Note that the fact that Bob is from the US with access to highly sensitive data is not explicitly captured in the above policies. Nor are the sensitivity levels of the two sets of columns. This knowledge is implicit only, making the policies difficult to maintain over time as business rules change.</p>
- <p class=MsoNormal> </p>
-
- <h1>Tag-based and Role-based Access Control: USSales</h1>
- <p class=MsoNormal>In this section we will explore using tags and roles (TBAC and RBAC) to set up access control on the USSales table.</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Let’s use tags to capture metadata relevant to access control, and assign them to tables and columns as shown below:</p>
- <p class=MsoNormal> </p>
-
- <table class=MsoTableGrid border=1 cellspacing=0 cellpadding=0 width=511 style='width:383.4pt;margin-left:30.35pt;border-collapse:collapse;border:none'>
- <tr>
- <td width=205 valign=top style='width:153.45pt;border:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;text-align:center'><p class=MsoNormal><b><span style='font-size:10.0pt'>Table/Columns</span></b></p></td>
- <td width=113 valign=top style='width:84.8pt;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt;text-align:center'><p class=MsoNormal><b><span style='font-size:10.0pt'>Tag</span></b></p></td>
- <td width=194 valign=top style='width:145.15pt;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt;text-align:center'><p class=MsoNormal><b><span style='font-size:10.0pt'>Tag Attribute</span></b></p></td>
- </tr>
- <tr>
- <td width=205 valign=top style='width:153.45pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>USSales</p></td>
- <td width=113 valign=top style='width:84.8pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>salesRegion</p></td>
- <td width=194 valign=top style='width:145.15pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>value="US"</p></td>
- </tr>
- <tr>
- <td width=205 valign=top style='width:153.45pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>c1, c2, c3, c4, c5</p></td>
- <td width=113 valign=top style='width:84.8pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>sensitivityLevel</p></td>
- <td width=194 valign=top style='width:145.15pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>value="sensitive"</p></td>
- </tr>
- <tr>
- <td width=205 valign=top style='width:153.45pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>c6, c7, c8</p></td>
- <td width=113 valign=top style='width:84.8pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>sensitivityLevel</p></td>
- <td width=194 valign=top style='width:145.15pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>value="highlySensitive"</p></td>
- </tr>
- </table>
-
- <p class=MsoNormal> </p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Let’s use the following roles to capture users’ access scope by sensitivity level and region, and assign users as members of the appropriate roles:</p>
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal align=center style='text-align:center'>
- <img width=700 height=380 border=1 id="Picture 23" src="adventures_in_abac_1.files/fig06-roles_capturing_sl_sr.jpg" alt="Fig 6. Apache Ranger™ roles to capture sensitivity level and sales region for users">
- </p>
-
- <p class=MsoNormal> </p>
- <p class=MsoNormal align=center style='text-align:center'>Fig 6. Apache Ranger™ roles to capture sensitivity level and sales region for users</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal>Tag-based and role-based access-control policies might include:</p>
-
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'>1.<span style='font:7.0pt "Times New Roman"'> </span>Tag: salesRegion</p>
- <p class=MsoListParagraphCxSpMiddle style='margin-left:1.0in;
- text-indent:-.25in'>a.<span style='font:7.0pt "Times New Roman"'> </span>Allow users in role salesRegion.US to access resources tagged with salesRegion.value = "US"</p>
- <p class=MsoListParagraphCxSpLast style='margin-left:1.0in;
- text-indent:-.25in'>b.<span style='font:7.0pt "Times New Roman"'> </span>Allow users in role salesRegion.EMEA to access resources tagged with salesRegion.value = "EMEA"</p>
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal align=center style='text-align:center'>
- <img width=700 height=800 border=1 id="Picture 24" src="adventures_in_abac_1.files/fig07-policy_ussales_tag_attribute_based.jpg" alt="Fig 7. Apache Ranger™ tag attribute-based access policy for sales region">
- </p>
-
- <p class=MsoNormal> </p>
- <p class=MsoNormal align=center style='text-align:center'>Fig 7. Apache Ranger™ tag attribute-based access policy for sales region</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal> </p>
-
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'>2.<span style='font:7.0pt "Times New Roman"'> </span>Tag: sensitivityLevel</p>
- <p class=MsoListParagraphCxSpMiddle style='margin-left:1.0in;text-indent:-.25in'>a.<span style='font:7.0pt "Times New Roman"'> </span>Allow users in role sensitivityLevel.sensitive to access resources tagged with sensitivityLevel.value = "sensitive", OR empty.</p>
- <p class=MsoListParagraphCxSpLast style='margin-left:1.0in;
- text-indent:-.25in'>b.<span style='font:7.0pt "Times New Roman"'> </span>Allow users in role sensitivityLevel.highlySensitive to access resources tagged with sensitivityLevel.value = "sensitive" OR "highlySensitive", OR empty.</p>
- <p class=MsoNormal> </p>
-
- <p class=MsoListParagraph align=center style='margin-left:0in;text-align:center'>
- <img width=700 height=800 border=1 id="Picture 25" src="adventures_in_abac_1.files/fig08-policy_tag_based_sl.jpg" alt="Fig 8. Apache Ranger™ tag attribute-based access policy for sensitivity level">
- </p>
-
- <p class=MsoNormal> </p>
- <p class=MsoNormal align=center style='text-align:center'>Fig 8. Apache Ranger™ tag attribute-based access policy for sensitivity level</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal>Note that the knowledge needed for access control is now explicit: the columns’ metadata is tagged with an explicit sensitivity level, and the users are explicitly members of the appropriate salesRegion role. </p>
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal><span style='color:black'>Note that these tag policies can be used to handle an EMEASales table as well as the USSales table, depending on whether the value of the tag is ‘US’ or ‘EMEA’.</span></p>
- <p class=MsoNormal> </p>
-
- <h1>Tag-based and Role-based Access Control: GlobalSales</h1>
-
- <p class=MsoNormal>In this section we return to the GlobalSales table. In this case we can’t use a simple salesRegion tag on the table, since the table contains data from multiple regions including US and EMEA. A row-filter is needed, as in the resource-based policy above. </p>
-
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal>As before, let’s use the following tags to capture metadata relevant to sensitivity access control, and have them assigned to columns as shown below:</p>
-
- <p class=MsoNormal> </p>
-
- <table class=MsoTableGrid border=1 cellspacing=0 cellpadding=0 width=511 style='width:383.4pt;margin-left:30.35pt;border-collapse:collapse;border:none'>
- <tr>
- <td width=205 valign=top style='width:153.45pt;border:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;text-align:center'><p class=MsoNormal><b><span style='font-size:10.0pt'>Columns</span></b></p></td>
- <td width=113 valign=top style='width:84.8pt;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt;text-align:center'><p class=MsoNormal><b><span style='font-size:10.0pt'>Tag</span></b></p></td>
- <td width=194 valign=top style='width:145.15pt;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt;text-align:center'><p class=MsoNormal><b><span style='font-size:10.0pt'>Tag Attribute</span></b></p></td>
- </tr>
- <tr>
- <td width=205 valign=top style='width:153.45pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>c2, c3</p></td>
- <td width=113 valign=top style='width:84.8pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>sensitivityLevel</p></td>
- <td width=194 valign=top style='width:145.15pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>value="sensitive"</p></td>
- </tr>
- <tr>
- <td width=205 valign=top style='width:153.45pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>c11, c12, c13, c14</p></td>
- <td width=113 valign=top style='width:84.8pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>sensitivityLevel</p></td>
- <td width=194 valign=top style='width:145.15pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>value="highlySensitive"</p></td>
- </tr>
- </table>
-
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal>Also, let’s use the same roles listed in the previous use case, Fig. 6</p>
-
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal>Tag-based and role-based access-control policies might include:</p>
-
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'>1.<span style='font:7.0pt "Times New Roman"'> </span>Tag: sensitivityLevel: same policy as the previous use case, Fig. 8</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>2.<span style='font:7.0pt "Times New Roman"'> </span>Row filter Policy:</p>
- <p class=MsoListParagraphCxSpMiddle style='margin-left:1.0in;text-indent:-.25in'>a.<span style='font:7.0pt "Times New Roman"'> </span>Users in the salesRegion.US role have access to rows where salesRegion = "US"</p>
- <p class=MsoListParagraphCxSpLast style='margin-left:1.0in;text-indent:-.25in'>b.<span style='font:7.0pt "Times New Roman"'> </span>Users in the salesRegion.EMEA role have access to rows where salesRegion = "EMEA"</p>
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal align=center style='text-align:center'>
- <img width=700 height=800 border=1 id="Picture 28" src="adventures_in_abac_1.files/fig09-policy_globalsales_row_filter_sr_roles.jpg" alt="Fig 9. Apache Ranger™ row-filter policy to restrict access to data in table GlobalSales based on sales region and user roles">
- </p>
-
- <p class=MsoNormal> </p>
- <p class=MsoNormal align=center style='text-align:center'>Fig 9. Apache Ranger™ row-filter policy to restrict access to data in table GlobalSales based on sales region and user roles</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal>This policy controls access by any user who has been assigned to a salesRegion role, not simply bob or celestine. </p>
- <p class=MsoNormal> </p>
-
- <h1>Beyond Tag-based and Role-based Access Control: GlobalSalesPartners</h1>
- <p class=MsoNormal>As our final level of complexity, in this section we will extend access control to a GlobalSalesPartners table that includes info on which business partner ("ABC" or "XYZ") produced the data.</p>
-
- <p class=MsoNormal> </p>
- <p class=MsoNormal>
- <img width=780 height=180 id="Picture 8" src="adventures_in_abac_1.files/table_globalsalespartners.jpg" alt="Table GlobalSalesPartners">
- </p>
-
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal>The following additional conditions must be enforced for accessing data in this table:</p>
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'>1.<span style='font:7.0pt "Times New Roman"'> </span>Bob can see only data from partner "ABC"</p>
- <p class=MsoListParagraphCxSpLast style='text-indent:-.25in'>2.<span style='font:7.0pt "Times New Roman"'> </span>Celestine can see data from both partners.</p>
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal>As before, let’s use the following tags to capture metadata relevant to sensitivity level, and have them assigned to columns as shown below:</p>
- <p class=MsoNormal> </p>
-
- <table class=MsoTableGrid border=1 cellspacing=0 cellpadding=0 width=511 style='width:383.4pt;margin-left:30.35pt;border-collapse:collapse;border:none'>
- <tr>
- <td width=205 valign=top style='width:153.45pt;border:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;text-align:center'><p class=MsoNormal><b><span style='font-size:10.0pt'>Columns</span></b></p></td>
- <td width=113 valign=top style='width:84.8pt;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt;text-align:center'><p class=MsoNormal><b><span style='font-size:10.0pt'>Tag</span></b></p></td>
- <td width=194 valign=top style='width:145.15pt;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt;text-align:center'><p class=MsoNormal><b><span style='font-size:10.0pt'>Tag Attribute</span></b></p></td>
- </tr>
- <tr>
- <td width=205 valign=top style='width:153.45pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>c2, c3</p></td>
- <td width=113 valign=top style='width:84.8pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>sensitivityLevel</p></td>
- <td width=194 valign=top style='width:145.15pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>value="sensitive"</p></td>
- </tr>
- <tr>
- <td width=205 valign=top style='width:153.45pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>c11, c12, c13, c14</p></td>
- <td width=113 valign=top style='width:84.8pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>sensitivityLevel</p></td>
- <td width=194 valign=top style='width:145.15pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>value="highlySensitive"</p></td>
- </tr>
- </table>
-
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal>Let’s use the following roles to capture the users’ access scope by sensitivity level, region, and sales partner, and assign our users as members of the appropriate roles:</p>
-
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal align=center style='text-align:center'>
- <img width=700 height=380 border=1 id="Picture 29" src="adventures_in_abac_1.files/fig10-roles_capturing_sl_sr_sp.jpg" alt="Fig 10. Apache Ranger™ roles to capture sensitivity level, sales region and sales partners for users">
- </p>
-
- <p class=MsoNormal> </p>
- <p class=MsoNormal align=center style='text-align:center'>Fig 10. Apache Ranger™ roles to capture sensitivity level, sales region and sales partners for users</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal>Tag-based and role-based access-control policies might include:</p>
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'>1.<span style='font:7.0pt "Times New Roman"'> </span>Tag: sensitivityLevel: same policy as earlier use case, Fig. 8</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>2.<span style='font:7.0pt "Times New Roman"'> </span>Row filter Policy:</p>
- <p class=MsoListParagraphCxSpMiddle style='margin-left:1.0in;text-indent:-.25in'>a.<span style='font:7.0pt "Times New Roman"'> </span>Users in salesRegion.US role have access to rows where salesRegion = "US"</p>
- <p class=MsoListParagraphCxSpMiddle style='margin-left:1.0in;text-indent:-.25in'>b.<span style='font:7.0pt "Times New Roman"'> </span>Users in salesRegion.EMEA role have access to rows where salesRegion = "EMEA"</p>
- <p class=MsoListParagraphCxSpMiddle style='margin-left:1.0in;text-indent:-.25in'>c.<span style='font:7.0pt "Times New Roman"'> </span>Users in salesPartner.ABC role have access to rows where salesPartner = "ABC"</p>
- <p class=MsoListParagraphCxSpLast style='margin-left:1.0in;text-indent:-.25in'>d.<span style='font:7.0pt "Times New Roman"'> </span>Users in salesPartner.XYZ role has access to rows where salesPartner = "XYZ"</p>
-
- <p class=MsoNormal> </p>
- <p class=MsoNormal align=center style='margin-left:0in;text-align:center'>
- <img width=700 height=800 border=1 id="Picture 36" src="adventures_in_abac_1.files/fig11-policy_globalsalespartners_row_filter_sr_sp.jpg" alt="Fig 11. Apache Ranger™ row-filter policy to restrict access to data in table GlobalSalesPartners based on sales region and sales partner">
- </p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal align=center style='text-align:center'>Fig 11. Apache Ranger™ row-filter policy to restrict access to data in table GlobalSalesPartners based on sales region and sales partner</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal>It is easy to see that as the numbers of salesRegions and salesPartners rise, the number of roles and row filter conditions increases combinatorially, and rapidly becomes difficult to manage. </p>
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal>As I said before, built-in Apache Ranger™ TBAC, RBAC, and row-filter based access policies are powerful, but they are not sufficient for complex access control constraints, like above. Join in to part 2 of this blog series to see how ABAC can answer these and other more complex constraint requirements, and do it…well, elegantly!</p>
- <p class=MsoNormal> </p>
- </div>
-
- <div>
- <br clear=all>
- <hr align=left size=1 width="33%">
- <div id=ftn1>
- <p class=MsoNormal><a href="#_ftnref1" name="_ftn1" title=""><span style='font-size:12.0pt;font-family:"Calibri",sans-serif'>[1]</span></a>Specifying expiration dates for access control policies where relevant. This is not specific to ABAC and so we won’t discuss it further in this blog series.</p>
- <p class=MsoFootnoteText> </p>
- </div>
-
- <div id=ftn2>
- <p class=MsoNormal><a href="#_ftnref2" name="_ftn2" title=""><span style='font-size:12.0pt;font-family:"Calibri",sans-serif'>[2]</span></a>We will cover details of masking policies in a subsequent blog.</p>
- <p class=MsoFootnoteText> </p>
- </div>
- </div>
- </div>
- </body>
-
- <footer>
- <div align=center >
- <a href="/blogs.html">Apache Ranger™ blogs</a>
- </div>
- </footer>
-</html>
diff --git a/docs/src/site/resources/blogs/adventures_in_abac_2.html b/docs/src/site/resources/blogs/adventures_in_abac_2.html
deleted file mode 100644
index 928e84098..000000000
--- a/docs/src/site/resources/blogs/adventures_in_abac_2.html
+++ /dev/null
@@ -1,312 +0,0 @@
-<!--
- Licensed to the Apache Software Foundation (ASF) under one or more
- contributor license agreements. See the NOTICE file distributed with
- this work for additional information regarding copyright ownership.
- The ASF licenses this file to You under the Apache License, Version 2.0
- (the "License"); you may not use this file except in compliance with
- the License. You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
--->
-<!DOCTYPE html>
-<html lang="en">
-
- <head>
- <meta http-equiv=Content-Type content="text/html; charset=utf-8">
- <title>Adventures in ABAC - Part 2</title>
- <style>
- <!--
- /* Font Definitions */
- @font-face {font-family:Wingdings; panose-1:5 0 0 0 0 0 0 0 0 0;}
- @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;}
- @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;}
- @font-face {font-family:"Calibri Light"; panose-1:2 15 3 2 2 2 4 3 2 4;}
-
- /* Style Definitions */
- p.MsoNormal, li.MsoNormal, div.MsoNormal
- {margin:0in; font-size:12.0pt; font-family:"Calibri",sans-serif;}
- h1
- {mso-style-link:"Heading 1 Char"; margin-top:12.0pt; margin-right:0in; margin-bottom:0in; margin-left:0in; page-break-after:avoid; font-size:16.0pt; font-family:"Calibri Light",sans-serif; color:#2F5496; font-weight:normal;}
-
- p.MsoFootnoteText, li.MsoFootnoteText, div.MsoFootnoteText
- {mso-style-link:"Footnote Text Char"; margin:0in; font-size:10.0pt; font-family:"Calibri",sans-serif;}
-
- p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
- {margin-top:0in; margin-right:0in; margin-bottom:0in; margin-left:.5in; font-size:12.0pt; font-family:"Calibri",sans-serif;}
- p.MsoListParagraphCxSpFirst, li.MsoListParagraphCxSpFirst, div.MsoListParagraphCxSpFirst
- {margin-top:0in; margin-right:0in; margin-bottom:0in; margin-left:.5in; font-size:12.0pt; font-family:"Calibri",sans-serif;}
- p.MsoListParagraphCxSpMiddle, li.MsoListParagraphCxSpMiddle, div.MsoListParagraphCxSpMiddle
- {margin-top:0in; margin-right:0in; margin-bottom:0in; margin-left:.5in; font-size:12.0pt; font-family:"Calibri",sans-serif;}
- p.MsoListParagraphCxSpLast, li.MsoListParagraphCxSpLast, div.MsoListParagraphCxSpLast
- {margin-top:0in; margin-right:0in; margin-bottom:0in; margin-left:.5in; font-size:12.0pt; font-family:"Calibri",sans-serif;}
- span.Heading1Char
- {mso-style-name:"Heading 1 Char"; mso-style-link:"Heading 1"; font-family:"Calibri Light",sans-serif; color:#2F5496;}
- span.FootnoteTextChar
- {mso-style-name:"Footnote Text Char"; mso-style-link:"Footnote Text";}
- .MsoChpDefault
- {font-family:"Calibri",sans-serif;}
-
- /* Page Definitions */
- @page WordSection1
- {size:8.5in 11.0in; margin:1.0in 1.0in 1.0in 1.0in;}
- div.WordSection1
- {page:WordSection1;}
-
-
- /* List Definitions */
- ol
- {margin-bottom:0in;}
- ul
- {margin-bottom:0in;}
- -->
- </style>
- </head>
-
- <body lang=EN-US style='width:800px;word-wrap:break-word;align:center;margin:auto;border:ridge' >
- <div style="margin-left:10pt;margin-right:10pt">
- <h1 style="text-align:center">Adventures in attribute-based access control (ABAC) - Part 2</h1>
- <p class=MsoNormal style='font:5.0pt "Times New Roman"'> </p>
- <div style="text-align:center">
- <p class=MsoNormal>Barbara Eckman, Ph.D., Distinguished Architect, Comcast</p>
- <p class=MsoNormal>Oct 15, 2023</p>
- </div>
- <p class=MsoNormal> </p>
-
- <div class=WordSection>
- <h1>Introduction</h1>
-
- <p class=MsoNormal>
- Previously in <a href="./adventures_in_abac_1.html">Part 1</a> of this series we examined an increasingly
- complex series of use cases involving role membership and row filtering. While built-in Apache Ranger™
- TBAC, RBAC, and row-filter based access policies are powerful, they may not be sufficient for complex access
- control constraints. As the numbers of row filters that must be simultaneously enforced rises, the number of
- roles and row filter conditions increases combinatorially and rapidly becomes difficult to manage.
- </p>
-
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal>
- This post introduces the principles of Attribute-based Access Control (ABAC) and shows how they enable us to
- avoid this potentially mushrooming complexity. Let’s recall the final use case from part 1.
- </p>
-
- <p class=MsoNormal> </p>
-
- <h1>Recap: GlobalSalesPartners table row filters</h1>
- <p class=MsoNormal>
- The GlobalSalesPartners table includes info on which business partner (“ABC” or “XYZ”) produced the data, as
- well as the salesRegion where the sale occurred.
- </p>
- <p class=MsoNormal align=center style='text-align:center'>
- <img width=780 height=180 id="Picture 6" src="adventures_in_abac_2.files/table_globalsalespartners.jpg" alt="Table USSales">
- </p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Recall our favorite users:</p>
-
- <table class=MsoTableGrid border=1 cellspacing=0 cellpadding=0 style='margin-left:30.35pt;border-collapse:collapse;border:none'>
- <tr>
- <td width=90 valign=top style='width:67.25pt;border:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;text-align:center'><p class=MsoNormal><b>User</b></p></td>
- <td width=102 valign=top style='width:76.5pt;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt;text-align:center'><p class=MsoNormal><b>Region</b></p></td>
- <td width=132 valign=top style='width:99.0pt;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt;text-align:center'><p class=MsoNormal><b>Partner</b></p></td>
- </tr>
- <tr>
- <td width=90 valign=top style='width:67.25pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Bob</p></td>
- <td width=102 valign=top style='width:76.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>US</p></td>
- <td width=132 valign=top style='width:99.0pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>ABC</p></td>
- </tr>
- <tr>
- <td width=90 valign=top style='width:67.25pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Celestine</p></td>
- <td width=102 valign=top style='width:76.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>EMEA</p></td>
- <td width=132 valign=top style='width:99.0pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>ABC, XYZ</p></td>
- </tr>
- </table>
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal>Row-filter policies from part 1:</p>
-
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'><span style='font-family:Symbol'>1. <span style='font:7.0pt "Times New Roman"'> </span></span>Users in salesRegion.US role have access to rows where salesRegion = “US”</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'><span style='font-family:Symbol'>2. <span style='font:7.0pt "Times New Roman"'> </span></span>Users in salesRegion.EMEA role have access to rows where salesRegion = “EMEA”</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'><span style='font-family:Symbol'>3. <span style='font:7.0pt "Times New Roman"'> </span></span>Users in salesPartner.ABC role have access to rows where salesPartner = “ABC”</p>
- <p class=MsoListParagraphCxSpLast style='text-indent:-.25in'><span style='font-family:Symbol'>4. <span style='font:7.0pt "Times New Roman"'> </span></span>Users in salesPartner.XYZ role has access to rows where salesPartner = “XYZ”</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal align=center style='text-align:center'>
- <img width=700 height=800 border=1 id="policy_table_ussales_rib" src="adventures_in_abac_2.files/fig1-policy_globalsalespartners_row_filter_sr_sp.jpg" alt="Fig 1. Apache Ranger™ Table GlobalSalesPartners: row-filter policy to restrict access based on sales region and sales partner">
- </p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal align=center style='text-align:center'>Fig 1. Apache Ranger™ Table GlobalSalesPartners: row-filter policy to restrict access based on sales region and sales partner</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>
- We noted previously that as the numbers of salesRegions and salesPartners rise, the number of
- roles and row filter conditions increases combinatorially, and rapidly becomes difficult to manage.
- </p>
-
- <p class=MsoNormal><span style='font-size:16.0pt;font-family:"Calibri Light",sans-serif;color:#2F5496'> </span></p>
-
- <h1>ABAC Principles</h1>
- <p class=MsoNormal>
- But what if Ranger policy engine had direct access to Bob‘s sales partners, and Bob‘s sales region, without
- reference to any roles he might be a member of? Then a row filter could be expressed this way, assuming Bob
- has access to data from only one sales region and sales partner
- </p>
-
- <p class=MsoNormal><span style='font-size:8.0pt;font-family:"Calibri Light",sans-serif;color:#2F5496'> </span></p>
-
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'><span style='font-family:Symbol'><span style='font:7.0pt "Times New Roman"'> </span></span><partner attribute value in row> == <Bob’s partner> AND <sales region value in row> == <Bob’s region></p>
-
- <p class=MsoNormal><span style='font-size:16.0pt;font-family:"Calibri Light",sans-serif;color:#2F5496'> </span></p>
-
- <p class=MsoNormal>Now assume this can be generalized to work for all users:</p>
-
- <p class=MsoNormal><span style='font-size:8.0pt;font-family:"Calibri Light",sans-serif;color:#2F5496'> </span></p>
-
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'><span style='font-family:Symbol'><span style='font:7.0pt "Times New Roman"'> </span></span><partner attribute value in row> == $USER.partner AND <sales region value in row> == $USER.region</p>
-
- <h1>Welcome to Attribute Based Access Control (ABAC)!</h1>
- <p class=MsoNormal>
- In RBAC, the role to which a user is assigned membership is the central method of expressing what the user
- should be allowed access to. Bob is in the role partner.ABC, along with, say, Sarah and Thomas and Srikanth
- and Joon. Thus, all these users have access to partner ABC’s data.
- </p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>
- In ABAC, the central method of expressing what the user should be allowed to have access to is the value of
- the user’s attributes. Bob’s partner attribute value equals “ABC”, along with the partner attribute of Sarah
- and Thomas and Srikanth and Joon. Just as in the RBAC case, all these users have access to partner ABC’s data.
- </p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>
- But how do we program this in Apache Ranger? Apache Ranger uses a user-store, populated with users and their
- attributes typically loaded from LDAP, SCIM, Azure Active Directory (AAD), Okta, etc., by Apache Ranger
- usersync. If an attribute named partner is added to a user’s record on the identity provider, then that
- information will be gathered as part of the usersync and can be referenced within a Ranger policy condition
- as $USER.partner.
- </p>
- <p class=MsoNormal> </p>
- <h1>GlobalSalesPartners Row-Filters Using ABAC</h1>
- <p class=MsoNormal>
- Assume that the UserStore has been populated with salesRegion and salesPartner attributes for Bob and
- Celestine as follows:
- </p>
- <p class=MsoNormal> </p>
-
- <table class=MsoTableGrid style='width:225pt;margin-left:30.35pt;border-collapse:collapse;border:none'>
- <tr>
- <td style='width:75pt;border:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;text-align:center'><p class=MsoNormal><b><span style='font-size:10.0pt'>User</span></b></p></td>
- <td style='width:75pt;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt;text-align:center'><p class=MsoNormal><b><span style='font-size:10.0pt'>salesRegion</span></b></p></td>
- <td style='width:75pt;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt;text-align:center'><p class=MsoNormal><b><span style='font-size:10.0pt'>salesPartner</span></b></p></td>
- </tr>
- <tr>
- <td style='width:75pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Bob</p></td>
- <td style='width:75pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>US</p></td>
- <td style='width:75pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>ABC</p></td>
- </tr>
- <tr>
- <td style='width:75pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Celestine</p></td>
- <td style='width:75pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>EMEA</p></td>
- <td style='width:75pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>XYZ</p></td>
- </tr>
- </table>
-
- <p class=MsoNormal> </p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>
- With ABAC, the 8 row filter conditions from the previous blog post become a single condition, matching the
- users’ partners and regions with the value in the salesPartner and salesRegion columns:
- </p>
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal align=center style='text-align:center'>
- <img width=700 height=380 border=1 id="Picture 23" src="adventures_in_abac_2.files/fig2-policy_globalsalespartners_row_filter_abac.jpg" alt="Fig 2. Apache Ranger™ Table GlobalSalesPartners: ABAC-based row-filter policy to restrict access based on sales region and sales partner">
- </p>
-
- <p class=MsoNormal> </p>
- <p class=MsoNormal align=center style='text-align:center'>Fig 2. Apache Ranger™ Table GlobalSalesPartners: ABAC-based row-filter policy to restrict access based on sales region and sales partner</p>
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal> </p>
- <p class=MsoNormal>
- This policy works for all users, not just those with salesRegion or salesPartner access like Bob’s or Celestine’s.
- </p>
-
- <h1>ABAC in Tag-Based Policies</h1>
- <p class=MsoNormal>
- Next, consider tables representing a single sales region, like USSales from blog post Part 1.
- </p>
- <p class=MsoNormal> </p>
-
- <table class=MsoTableGrid style='width:300pt;margin-left:30.35pt;border-collapse:collapse;border:none'>
- <tr>
- <td style='width:125pt;border:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;text-align:center'><p class=MsoNormal><b><span style='font-size:10.0pt'>Resource</span></b></p></td>
- <td style='width:75pt;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt;text-align:center'><p class=MsoNormal><b><span style='font-size:10.0pt'>Tag</span></b></p></td>
- <td style='width:100pt;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt;text-align:center'><p class=MsoNormal><b><span style='font-size:10.0pt'>Tag Attribute</span></b></p></td>
- </tr>
- <tr>
- <td style='width:125pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Table: USSales</p></td>
- <td style='width:75pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>salesRegion</p></td>
- <td style='width:100pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>value=”US”</p></td>
- </tr>
- </table>
-
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal>
- Allow only users in the salesRegion.US role to access resources tagged with salesRegion.value = ”US”. Create
- a role-based (RBAC) tag policy that allows access to tagged tables based on the role membership of the user:
- </p>
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal align=center style='text-align:center'>
- <img width=700 height=380 border=1 id="Picture 23" src="adventures_in_abac_2.files/fig3-policy_tag_based_on_user_role.jpg" alt="Fig 3. Apache Ranger™ Tag-based policy allowing access to tagged tables based on the user’s role membership">
- </p>
-
- <p class=MsoNormal> </p>
- <p class=MsoNormal align=center style='text-align:center'>Fig 3. Apache Ranger™ Tag-based policy allowing access to tagged tables based on the user’s role membership</p>
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal>
- Using the RBAC method, we need to create a policy condition for each of the salesRegion.* roles. Depending on
- how many salesRegions a company defines, this could get large. And if they are continually being added or
- subtracted, the policy has to be commensurately updated.
- </p>
-
- <p class=MsoNormal> </p>
- <p class=MsoNormal>
- Let’s use ABAC to greatly simplify this process, by creating a tag policy that allows table access to any user
- whose salesRegion attribute matches the attribute of the salesRegion tag:
- </p>
-
- <p class=MsoNormal align=center style='text-align:center'>
- <img width=700 height=380 border=1 id="Picture 23" src="adventures_in_abac_2.files/fig4-policy_tag_policy_abac.jpg" alt="Fig 3. Apache Ranger™ ABAC-based tag policy to allow access to tables based on the value of the user’s attribute.">
- </p>
-
- <p class=MsoNormal> </p>
- <p class=MsoNormal align=center style='text-align:center'>Fig 4. Apache Ranger™ ABAC-based tag policy to allow access to tables based on the value of the user’s attribute.</p>
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal> </p>
- <p class=MsoNormal>
- As we have seen, ABAC makes policy creation and maintenance much easier! But what if the custodians of your
- Identity Provider are too busy to keep up with managing the additional attributes you need for ABAC? Is there
- another way to populate the UserStore? Yes! Check out Part 3 of this blog series to find out how you can
- retrieve UserStore entries from a variety of alternative sources!
- </p>
-
- <p class=MsoNormal> </p>
- </div>
- </div>
- </body>
-
- <footer>
- <div align=center >
- <a href="/blogs.html">Apache Ranger™ blogs</a>
- </div>
- </footer>
-</html>
diff --git a/docs/src/site/resources/blogs/blog.css b/docs/src/site/resources/blogs/blog.css
new file mode 100644
index 000000000..4c79e0ccc
--- /dev/null
+++ b/docs/src/site/resources/blogs/blog.css
@@ -0,0 +1,512 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+:root {
+ --blog-bg: #f4f6f9;
+ --blog-surface: #ffffff;
+ --blog-text: #1e293b;
+ --blog-muted: #64748b;
+ --blog-heading: #0f172a;
+ --blog-accent: #1d6f5c;
+ --blog-accent-hover: #155e4d;
+ --blog-border: #e2e8f0;
+ --blog-code-bg: #f1f5f9;
+ --blog-table-bg: #ffffff;
+ --blog-table-header-bg: #f1f5f9;
+ --blog-table-border: #94a3b8;
+ --blog-table-stripe: #f8fafc;
+ --blog-max-width: 46rem;
+}
+
+@media (prefers-color-scheme: dark) {
+ :root {
+ --blog-bg: #0f1419;
+ --blog-surface: #1a2332;
+ --blog-text: #e2e8f0;
+ --blog-muted: #94a3b8;
+ --blog-heading: #f8fafc;
+ --blog-accent: #5fffd7;
+ --blog-accent-hover: #7bffe0;
+ --blog-border: #334155;
+ --blog-code-bg: #0f172a;
+ --blog-table-bg: #243044;
+ --blog-table-header-bg: #2f3f56;
+ --blog-table-border: #64748b;
+ --blog-table-stripe: #1f2d40;
+ }
+}
+
+*, *::before, *::after {
+ box-sizing: border-box;
+}
+
+/* Blog posts rendered inside the Maven site skin */
+.ranger-blog-post {
+ max-width: var(--blog-max-width);
+ margin: 0 auto;
+ padding: 0 0 1.5rem;
+ color: var(--blog-text);
+ font-size: 1.0625rem;
+ line-height: 1.75;
+ word-wrap: break-word;
+}
+
+/* Section h2 from XDoc is the blog post title (one title only) */
+.body-content .section:has(> .ranger-blog-post) > h2 {
+ max-width: var(--blog-max-width);
+ margin: 0 auto 0.75rem;
+ padding: 0;
+ border: none;
+ font-size: clamp(1.65rem, 4vw, 2.2rem);
+ font-weight: 700;
+ line-height: 1.25;
+ letter-spacing: -0.02em;
+ color: var(--blog-heading);
+ text-align: left;
+}
+
+.body-content .section:has(> .ranger-blog-post) > h2 + .ranger-blog-post {
+ margin-top: 0;
+}
+
+.ranger-blog__back {
+ margin: 0 0 1.25rem;
+ font-size: 0.875rem;
+}
+
+.ranger-blog__back a {
+ color: var(--blog-muted);
+ text-decoration: none;
+}
+
+.ranger-blog__back a:hover {
+ color: var(--blog-accent);
+}
+
+.ranger-blog__title {
+ margin: 0 0 0.75rem;
+ font-size: clamp(1.65rem, 4vw, 2.2rem);
+ font-weight: 700;
+ line-height: 1.25;
+ letter-spacing: -0.02em;
+ color: var(--blog-heading);
+ text-align: left;
+}
+
+.ranger-blog__meta {
+ margin: 0 0 2rem;
+ padding-bottom: 1.25rem;
+ border-bottom: 1px solid var(--blog-border);
+ font-size: 0.9375rem;
+ color: var(--blog-muted);
+}
+
+.ranger-blog__body h1 {
+ margin: 2.25rem 0 0.85rem;
+ font-size: 1.45rem;
+ font-weight: 600;
+ line-height: 1.3;
+ color: var(--blog-heading);
+ page-break-after: auto;
+}
+
+.ranger-blog__body h1:first-child {
+ margin-top: 0;
+}
+
+.ranger-blog__body h2 {
+ margin: 1.75rem 0 0.65rem;
+ font-size: 1.2rem;
+ font-weight: 600;
+ line-height: 1.35;
+ color: var(--blog-heading);
+}
+
+.ranger-blog__body h3 {
+ margin: 1.35rem 0 0.5rem;
+ font-size: 1.05rem;
+ font-weight: 600;
+ color: var(--blog-heading);
+}
+
+.ranger-blog__body p {
+ margin: 0 0 0.65rem;
+ font-size: inherit;
+ font-family: inherit;
+ line-height: 1.65;
+ text-align: left;
+}
+
+.ranger-blog__body p:empty,
+.ranger-blog__body p:has(> br:only-child):not(.ranger-blog-code-line) {
+ display: none;
+ margin: 0;
+ padding: 0;
+ line-height: 0;
+}
+
+.ranger-blog__list-item {
+ margin: 0 0 0.35rem;
+ padding-left: 2.25rem;
+ text-indent: -0.25in;
+ text-align: left;
+ font-size: inherit;
+ font-family: inherit;
+}
+
+/* Intro feature lists in dynamic_expressions */
+.ranger-blog__body .ranger-blog__list-group .ranger-blog__list-item {
+ margin-left: 0.5in;
+}
+
+/* Nested sub-lists (a., b., c., …) */
+.ranger-blog__list-item--nested {
+ margin-left: 1.0in;
+}
+
+/* Policy-style list lines that should stay on one row */
+.ranger-blog__list-item--nowrap {
+ white-space: nowrap;
+ overflow-x: auto;
+}
+
+.ranger-blog-post a {
+ color: var(--blog-accent);
+ text-decoration: underline;
+ text-underline-offset: 2px;
+}
+
+.ranger-blog-post a:hover {
+ color: var(--blog-accent-hover);
+}
+
+.ranger-blog-post img {
+ display: block;
+ max-width: 100%;
+ height: auto;
+ margin: 1.25rem auto;
+ border: 1px solid var(--blog-border);
+ border-radius: 8px;
+}
+
+.ranger-blog-caption,
+.ranger-blog-post p[style*="text-align:center"] {
+ text-align: center !important;
+}
+
+.ranger-blog-caption:not(:has(img)),
+.ranger-blog-post p[style*="text-align:center"]:not(:has(img)) {
+ font-size: 0.875rem;
+ color: var(--blog-muted);
+ margin-top: -0.35rem;
+ margin-bottom: 1.25rem;
+}
+
+.ranger-blog-post pre.ranger-blog-pre,
+.ranger-blog-post pre {
+ margin: 1.1rem 0;
+ padding: 1rem 1.15rem;
+ font-size: 0.8125rem;
+ line-height: 1.55;
+ font-family: "Cascadia Code", "SF Mono", Consolas, "Courier New", monospace;
+ background: var(--blog-code-bg);
+ border: 1px solid var(--blog-border);
+ border-radius: 8px;
+ overflow-x: auto;
+ white-space: pre-wrap;
+ word-wrap: break-word;
+}
+
+.ranger-blog-post hr {
+ margin: 2rem 0;
+ border: none;
+ border-top: 1px solid var(--blog-border);
+}
+
+/* Tables */
+.ranger-blog-post table {
+ width: 100% !important;
+ max-width: 100%;
+ margin: 1.25rem 0 1.5rem !important;
+ margin-left: 0 !important;
+ border-collapse: collapse;
+ border: 1px solid var(--blog-table-border);
+ border-radius: 8px;
+ background: var(--blog-table-bg);
+ font-size: 0.9rem;
+ line-height: 1.5;
+ table-layout: auto;
+}
+
+.ranger-blog-post table.ranger-blog-table--expressions {
+ border-collapse: collapse;
+}
+
+/* Column 1: function names — shrink to content, single line */
+.ranger-blog-post table.ranger-blog-table--expressions td:nth-child(1),
+.ranger-blog-post table.ranger-blog-table--expressions th:nth-child(1) {
+ width: 1% !important;
+ white-space: nowrap;
+}
+
+/* Column 2: descriptions — use remaining space */
+.ranger-blog-post table.ranger-blog-table--expressions td:nth-child(2),
+.ranger-blog-post table.ranger-blog-table--expressions th:nth-child(2) {
+ width: auto !important;
+ white-space: normal;
+}
+
+/* Column 3: examples / JSON — fit content, don't stretch across the row */
+.ranger-blog-post table.ranger-blog-table--expressions td:nth-child(3),
+.ranger-blog-post table.ranger-blog-table--expressions th:nth-child(3) {
+ width: 1% !important;
+ max-width: 20rem;
+ white-space: normal;
+}
+
+.ranger-blog-post table.ranger-blog-table--expressions td:nth-child(3) p.ranger-blog-code-line {
+ white-space: pre !important;
+ overflow-x: auto;
+ padding: 0.1rem 0.35rem !important;
+ margin: 0 !important;
+ background: transparent !important;
+ border: none !important;
+ border-radius: 0;
+ line-height: 1.4 !important;
+}
+
+.ranger-blog-post table td,
+.ranger-blog-post table th {
+ border: 1px solid var(--blog-table-border) !important;
+ padding: 0.55rem 0.7rem !important;
+ background-color: var(--blog-table-bg) !important;
+ color: var(--blog-text) !important;
+ vertical-align: top;
+ word-wrap: break-word;
+ overflow-wrap: anywhere;
+}
+
+/* Left columns: shrink to content; avoid wrapping where practical */
+.ranger-blog-post table:not(.ranger-blog-table--expressions) td:not(:last-child),
+.ranger-blog-post table:not(.ranger-blog-table--expressions) th:not(:last-child) {
+ width: 1% !important;
+ white-space: nowrap;
+}
+
+/* Rightmost column: use all remaining width */
+.ranger-blog-post table td:last-child,
+.ranger-blog-post table th:last-child {
+ width: auto !important;
+ white-space: normal;
+}
+
+/* Service | Resource | Permission table: widen middle column for nested tables */
+.ranger-blog-post table.ranger-blog-table--resource td:nth-child(1),
+.ranger-blog-post table.ranger-blog-table--resource th:nth-child(1),
+.ranger-blog-post table.ranger-blog-table--resource td:nth-child(3),
+.ranger-blog-post table.ranger-blog-table--resource th:nth-child(3) {
+ width: 1% !important;
+ white-space: nowrap;
+}
+
+.ranger-blog-post table.ranger-blog-table--resource td:nth-child(2),
+.ranger-blog-post table.ranger-blog-table--resource th:nth-child(2) {
+ width: auto !important;
+ min-width: 16rem;
+ white-space: normal;
+}
+
+.ranger-blog-post table.ranger-blog-table--resource td:nth-child(2) table {
+ width: auto;
+ min-width: 100%;
+ margin: 0.25rem 0 !important;
+}
+
+.ranger-blog-post table.ranger-blog-table--resource td:nth-child(2) table td {
+ white-space: nowrap !important;
+ width: auto !important;
+}
+
+.ranger-blog-post table.ranger-blog-table--resource td:nth-child(2) table td:first-child {
+ width: 1% !important;
+}
+
+/* Header row styling for column-header tables only (direct rows, not nested tables) */
+.ranger-blog-post table:not(.ranger-blog-table--kv) > tr:first-child > td,
+.ranger-blog-post table:not(.ranger-blog-table--kv) > tr:first-child > th {
+ background-color: var(--blog-table-header-bg) !important;
+ color: var(--blog-heading) !important;
+ font-weight: 600;
+}
+
+/* Key-value tables: every row uses the same cell styling */
+.ranger-blog-post table.ranger-blog-table--kv td {
+ font-weight: normal;
+ color: var(--blog-text) !important;
+}
+
+.ranger-blog-post table.ranger-blog-table--kv samp {
+ font-family: inherit;
+ font-size: inherit;
+ font-weight: inherit;
+}
+
+.ranger-blog-post table > tr:nth-child(even) > td {
+ background-color: var(--blog-table-stripe) !important;
+}
+
+.ranger-blog-post table > tr:nth-child(even) > td p {
+ background: transparent !important;
+}
+
+.ranger-blog-post table p {
+ margin: 0 !important;
+ line-height: 1.45 !important;
+ color: inherit !important;
+}
+
+.ranger-blog-post table p.ranger-blog-code-line,
+.ranger-blog-post table span[style*="Courier New"] {
+ font-family: "Cascadia Code", "SF Mono", Consolas, "Courier New", monospace !important;
+ font-size: 0.8125rem !important;
+ background: transparent !important;
+ border: none !important;
+ padding: 0 !important;
+ white-space: normal !important;
+}
+
+.ranger-blog-post table b,
+.ranger-blog-post table strong {
+ color: var(--blog-heading);
+ font-weight: 600;
+}
+
+/* Nested tables inside cells */
+.ranger-blog-post table table {
+ margin: 0.35rem 0 !important;
+ font-size: 0.85rem;
+ border-radius: 4px;
+}
+
+.ranger-blog-post #ftn1 p,
+.ranger-blog-post #ftn2 p {
+ font-size: 0.875rem;
+ color: var(--blog-muted);
+}
+
+.ranger-blog__footer {
+ max-width: var(--blog-max-width);
+ margin: 0 auto;
+ padding: 0 1.25rem 2rem;
+ text-align: center;
+ font-size: 0.875rem;
+}
+
+.ranger-blog__footer a {
+ color: var(--blog-muted);
+ text-decoration: none;
+}
+
+.ranger-blog__footer a:hover {
+ color: var(--blog-accent);
+}
+
+/* Blog index (blogs.html) */
+.ranger-blog-index {
+ max-width: 52rem;
+ margin: 0 auto;
+ padding: 1rem 0 2rem;
+}
+
+.ranger-blog-index__intro {
+ margin: 0 0 2rem;
+ font-size: 1.05rem;
+ line-height: 1.65;
+ color: var(--blog-muted);
+}
+
+.ranger-blog-index__list {
+ list-style: none;
+ margin: 0;
+ padding: 0;
+ display: grid;
+ gap: 1rem;
+}
+
+.ranger-blog-index__card {
+ margin: 0;
+ padding: 1.25rem 1.5rem;
+ background: var(--blog-surface);
+ border: 1px solid var(--blog-border);
+ border-radius: 10px;
+ transition: border-color 0.15s ease, box-shadow 0.15s ease;
+}
+
+.ranger-blog-index__card:hover {
+ border-color: var(--blog-accent);
+ box-shadow: 0 4px 16px rgba(15, 23, 42, 0.08);
+}
+
+.ranger-blog-index__card a {
+ font-size: 1.125rem;
+ font-weight: 600;
+ color: var(--blog-heading);
+ text-decoration: none;
+}
+
+.ranger-blog-index__card a:hover {
+ color: var(--blog-accent);
+}
+
+.ranger-blog-index__summary {
+ margin: 0.5rem 0 0;
+ font-size: 0.9375rem;
+ line-height: 1.55;
+ color: var(--blog-text);
+}
+
+.ranger-blog-index__meta {
+ margin: 0.75rem 0 0;
+ font-size: 0.8125rem;
+ color: var(--blog-muted);
+}
+
+.ranger-blog-post code {
+ font-family: "Cascadia Code", "SF Mono", Consolas, "Courier New", monospace;
+ font-size: 0.9em;
+ background: var(--blog-code-bg);
+ padding: 0.1em 0.35em;
+ border-radius: 4px;
+ border: 1px solid var(--blog-border);
+}
+
+/* Inline code snippets */
+.ranger-blog-code-line,
+.ranger-blog-post p[style*="Courier New"] {
+ font-family: "Cascadia Code", "SF Mono", Consolas, "Courier New", monospace !important;
+ font-size: 0.85rem !important;
+ line-height: 1.5 !important;
+ background: var(--blog-code-bg);
+ padding: 0.75rem 1rem;
+ border-radius: 6px;
+ border: 1px solid var(--blog-border);
+ overflow-x: auto;
+ white-space: pre-wrap;
+ word-break: break-word;
+ margin-left: 0 !important;
+ text-indent: 0 !important;
+}
diff --git a/docs/src/site/resources/blogs/dynamic_expressions.html b/docs/src/site/resources/blogs/dynamic_expressions.html
deleted file mode 100644
index b00962474..000000000
--- a/docs/src/site/resources/blogs/dynamic_expressions.html
+++ /dev/null
@@ -1,668 +0,0 @@
-<!--
- Licensed to the Apache Software Foundation (ASF) under one or more
- contributor license agreements. See the NOTICE file distributed with
- this work for additional information regarding copyright ownership.
- The ASF licenses this file to You under the Apache License, Version 2.0
- (the "License"); you may not use this file except in compliance with
- the License. You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
--->
-<!DOCTYPE html>
-<html>
-<head>
- <meta http-equiv=Content-Type content="text/html; charset=utf-8">
- <title>Apache Ranger Policy Model</title>
- <style>
- <!--
- /* Font Definitions */
- @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;}
- @font-face {font-family:"Calibri Light"; panose-1:2 15 3 2 2 2 4 3 2 4;}
-
- /* Style Definitions */
- p.MsoNormal, li.MsoNormal, div.MsoNormal
- {margin:0in; font-size:12.0pt; font-family:"Calibri",sans-serif;}
- p.MsoSmaller, li.MsoNormal, div.MsoNormal
- {margin:0in; font-size:10.0pt; font-family:"Calibri",sans-serif;}
- p.MsoSmall, li.MsoNormal, div.MsoNormal
- {margin:0in; font-size:8.0pt; font-family:"Calibri",sans-serif;}
- p.HalfLine
- {margin:0in; font-size:6.0pt; font-family:"Calibri",sans-serif;}
- h1
- {mso-style-link:"Heading 1 Char"; margin-top:12.0pt; margin-right:0in; margin-bottom:0in; margin-left:0in; page-break-after:avoid; font-size:16.0pt; font-family:"Calibri Light",sans-serif; color:#2F5496; font-weight:normal;}
- h2
- {mso-style-link:"Heading 1 Char"; margin-top:10.0pt; margin-right:0in; margin-bottom:0in; margin-left:0in; page-break-after:avoid; font-size:14.0pt; font-family:"Calibri Light",sans-serif; color:#2F5496; font-weight:normal;}
-
- span.Heading1Char
- {mso-style-name:"Heading 1 Char"; mso-style-link:"Heading 1"; font-family:"Calibri Light",sans-serif; color:#2F5496;}
- span.FootnoteTextChar
- {mso-style-name:"Footnote Text Char"; mso-style-link:"Footnote Text";}
- .MsoChpDefault
- {font-family:"Calibri",sans-serif;}
-
- /* Page Definitions */
- @page WordSection1
- {size:8.5in 11.0in; margin:1.0in 1.0in 1.0in 1.0in;}
- div.WordSection1
- {page:WordSection1;}
-
- /* List Definitions */
- ol
- {margin-bottom:0in;}
- ul
- {margin-bottom:0in;}
- -->
- </style>
-</head>
-
-<body lang=EN-US style='width:800px;word-wrap:break-word;align:center;margin:auto;border:ridge'>
-<div style="margin-left:10pt;margin-right:10pt">
- <h1 style="text-align:center">Apache Ranger - Dynamic Expressions</h1>
- <p class=MsoNormal style='font:5.0pt "Times New Roman"'> </p>
- <div style="text-align:center">
- <p class=MsoNormal>Madhan Neethiraj, Apache Ranger committer</p>
- <p class=MsoNormal>Dec 12, 2023</p>
- </div>
- <p class=MsoNormal> </p>
-
- <div class=WordSection>
- <h1>Introduction</h1>
-
- <p class=MsoNormal>
- Apache Ranger policy model offers a rich set of features that help security administrators handle various
- access
- and governance requirements with ease. These features include:
- </p>
-
- <p class=HalfLine> </p>
-
- <span lang=ENG>
- <p class=MsoSmaller style='margin-left:0.5in;text-indent:-.25in'>1. Consistent model to authorize access data in large number of services</p>
- <p class=HalfLine> </p>
- <p class=MsoSmaller style='margin-left:0.5in;text-indent:-.25in'>2. Ability to dynamically apply data masking and row-filtering</p>
- <p class=HalfLine> </p>
- <p class=MsoSmaller style='margin-left:0.5in;text-indent:-.25in'>3. Delegated access control administration</p>
- <p class=HalfLine> </p>
- <p class=MsoSmaller style='margin-left:0.5in;text-indent:-.25in'>4. Ability to explicitly deny access</p>
- <p class=HalfLine> </p>
- <p class=MsoSmaller style='margin-left:0.5in;text-indent:-.25in'>5. Use of wildcards in resource names in access policies</p>
- <p class=HalfLine> </p>
- <p class=MsoSmaller style='margin-left:0.5in;text-indent:-.25in'>6. Role-based access control (RBAC)</p>
- <p class=HalfLine> </p>
- <p class=MsoSmaller style='margin-left:0.5in;text-indent:-.25in'>7. Tag-based access control (TBAC), based on tags associated with resources</p>
- <p class=HalfLine> </p>
- <p class=MsoSmaller style='margin-left:0.5in;text-indent:-.25in'>8. Attribute-based access control (ABAC), based on attributes of users, groups and tags</p>
- <p class=HalfLine> </p>
- </span>
-
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal>
- In addition to above, Apache Ranger policies can use various attributes available in the access context to
- authorize the access - attributes including resource owner, time of access, tags associated with the
- accessed
- resource, attributes of user/groups/tags, groups/roles the user belongs to. This document explores use cases
- that can leverage such attributes in policies using dynamic expressions.
- </p>
-
- <p class=MsoNormal> </p>
-
- <h1>Dynamic expressions</h1>
-
- <p class=MsoNormal>
- Apache Ranger policy engine evaluates dynamic expressions specified in policies using the script engine
- included in the JVM, in a sandboxed environment. Dynamic expressions can be used in Apache Ranger policies
- in
- following contexts:
- </p>
-
- <h2>Policy conditions</h2>
- <p class=MsoNormal>
- Expressions can used in policy conditions to decide whether to evaluate the policy or a policy-item. These
- expressions should evaluate to a boolean value i.e., <span lang=EN style='font-family:"Courier New"'>true</span>
- or <span lang=EN style='font-family:"Courier New"'>false</span>. Examples:
- </p>
- <p class=HalfLine> </p>
-
- <p class="MsoSmaller">Condition for highly sensitive data (level >= 10)</p>
- <p class=HalfLine> </p>
- <p class=MsoSmaller style='margin-left:1.0in;text-indent:-.25in;font-family:"Courier New"'>TAG.sensitiveLevel >= 10</p>
- <p class=HalfLine> </p>
-
- <p class="MsoSmaller">Condition to check if the user has appropriate level of clearance to access sensitive data</p>
- <p class=HalfLine> </p>
- <p class=MsoSmaller style='margin-left:1.0in;text-indent:-.25in;font-family:"Courier New"'>USER.allowedSensitiveLevel >= TAG.sensitiveLevel</p>
- <p class=HalfLine> </p>
-
- <p class="MsoSmaller">Condition to check if the user belongs to group <span lang=EN style='font-family:"Courier New"'>finance</span> and is in role <span lang=EN style='font-family:"Courier New"'>analyst</span></p>
- <p class=HalfLine> </p>
- <p class=MsoSmaller style='margin-left:1.0in;text-indent:-.25in;font-family:"Courier New"'>IS_IN_GROUP('finance') AND IS_IN_ROLE('analyst')</p>
- <p class=HalfLine> </p>
-
- <h2>Row filters</h2>
- <p class=MsoNormal>
- Expressions can be used to set up row-filters with dynamic values. To distinguish expressions from the rest
- of the row-filter text, they should be enclosed within delimiters <span lang=EN style='font-family:"Courier New"'>${{</span>
- and <span lang=EN style='font-family:"Courier New"'>}}</span>. Examples:
- </p>
- <p class=HalfLine> </p>
-
- <p class="MsoSmaller">Row-filter expression to restrict users to access only rows belonging to their department:</p>
- <p class=HalfLine> </p>
- <p class=MsoSmaller style='margin-left:1.0in;text-indent:-.25in;font-family:"Courier New"'>dept_code == ${{USER.department}}</p>
- <p class=HalfLine> </p>
-
- <p class="MsoSmaller">Row-filter expression to restrict users to access only rows from data sources specified in user attribute named <span lang=EN style='font-family:"Courier New"'>allowedSources</span>:</p>
- <p class=HalfLine> </p>
- <p class=MsoSmaller style='margin-left:1.0in;text-indent:-.25in;font-family:"Courier New"'>data_source in (${{USER.allowedSources}})</p>
- <p class=HalfLine> </p>
-
- <h2>Resource names</h2>
- <p class=MsoNormal>
- Use of expressions in resource names can help reduce the number of policies, which in
- turn makes it easier to manage policies. Examples:
- </p>
- <p class=HalfLine> </p>
-
- <p class="MsoSmaller">Policy resource for home directory of the user:</p>
- <p class=HalfLine> </p>
- <p class=MsoSmaller style='margin-left:1.0in;text-indent:-.25in;font-family:"Courier New"'>/home/${{REQ.user}}</p>
- <p class=HalfLine> </p>
-
- <p class="MsoSmaller">Policy resource for directory of user's department:</p>
- <p class=HalfLine> </p>
- <p class=MsoSmaller style='margin-left:1.0in;text-indent:-.25in;font-family:"Courier New"'>/data/dept/${{USER.dept}}</p>
- <p class=HalfLine> </p>
-
- <p class="MsoSmaller">Policy resource for database of user's department:</p>
- <p class=HalfLine> </p>
- <p class=MsoSmaller style='margin-left:1.0in;text-indent:-.25in;font-family:"Courier New"'>db_${{USER.dept}}</p>
- <p class=HalfLine> </p>
-
- <h1>Supported expressions</h1>
- <p class=MsoNormal> </p>
-
- <table class=a style='border-collapse: collapse;border:none'>
- <tr>
- <td style='width:150pt;border:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='text-align:center;line-height:normal; border:none'><b><span lang=EN>Variable/Function name</span></b></p>
- </td>
- <td style='width:275pt;border:solid black 1.0pt; border-left:none;padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='text-align:center;line-height:normal; border:none'><b><span lang=EN>Description</span></b></p>
- </td>
- <td style='width:225pt;border:solid black 1.0pt; border-left:none;padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='text-align:center;line-height:normal; border:none'><b><span lang=EN>Example values</span></b></p>
- </td>
- </tr>
- <tr>
- <td style='width:150pt;border:solid black 1.0pt; border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal;border:none'><span lang=EN>GET_TAG_NAMES()</span></p>
- </td>
- <td style='width:275pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal;border:none'><span lang=EN>Names of tags associated with the resource, as a CSV (comma separated values) string</span></p>
- </td>
- <td style='width:225pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoSmaller style='line-height:normal;border:none'><span lang=EN style='font-family:"Courier New"'>PII,FINANCE</span></p>
- </td>
- </tr>
- <tr>
- <td style='width:150pt;border:solid black 1.0pt; border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal;border:none'><span lang=EN>GET_TAG_ATTR_NAMES()</span></p>
- </td>
- <td style='width:275pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal'><span lang=EN>Names of attributes in all tags associated with the resource, as a CSV string</span></p>
- </td>
- <td style='width:225pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoSmaller style='line-height:normal;border:none'><span lang=EN style='font-family:"Courier New"'>piiType,sensitiveLevel</span></p>
- </td>
- </tr>
- <tr>
- <td style='width:150pt;border:solid black 1.0pt; border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal;border:none'><span lang=EN>GET_TAG_ATTR(attrName)</span></p>
- </td>
- <td style='width:275pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal;border:none'><span lang=EN>Value of the given attribute in tags associated with the resource, as a CSV string</span></p>
- </td>
- <td style='width:225pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoSmaller style='line-height:normal;border:none'><span lang=EN style='font-family:"Courier New"'>email</span></p>
- </td>
- </tr>
- <tr>
- <td style='width:150pt;border:solid black 1.0pt; border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal;border:none'><span lang=EN>GET_UG_NAMES()</span></p>
- </td>
- <td style='width:275pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal'><span lang=EN>Names of groups the user belongs to, as a CSV string</span></p>
- </td>
- <td style='width:225pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoSmaller style='line-height:normal;border:none'><span lang=EN style='font-family:"Courier New"'>managers,finance-admins</span></p>
- </td>
- </tr>
- <tr>
- <td style='width:150pt;border:solid black 1.0pt; border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal;border:none'><span lang=EN>GET_UG_ATTR_NAMES()</span></p>
- </td>
- <td style='width:275pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal'><span lang=EN>Names of all attributes in groups the user belongs to, as a CSV string</span></p>
- </td>
- <td style='width:225pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoSmaller style='line-height:normal;border:none'><span lang=EN style='font-family:"Courier New"'>attr1,attr2</span></p>
- </td>
- </tr>
- <tr>
- <td style='width:150pt;border:solid black 1.0pt; border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal;border:none'><span lang=EN>GET_UG_ATTR(attrName)</span></p>
- </td>
- <td style='width:275pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal'><span lang=EN>Value of the given attribute in groups the user belongs to, as a CSV string</span></p>
- </td>
- <td style='width:225pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoSmaller style='line-height:normal;border:none'><span lang=EN style='font-family:"Courier New"'>val1</span></p>
- </td>
- </tr>
- <tr>
- <td style='width:150pt;border:solid black 1.0pt; border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal;border:none'><span lang=EN>GET_UR_NAMES()</span></p>
- </td>
- <td style='width:275pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal;border:none'><span lang=EN>Names of roles assigned to the user, as a CSV string</span></p>
- </td>
- <td style='width:225pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoSmaller style='line-height:normal;border:none'><span lang=EN style='font-family:"Courier New"'>analyst,dba</span></p>
- </td>
- </tr>
- <tr>
- <td style='width:150pt;border:solid black 1.0pt; border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal;border:none'><span lang=EN>GET_USER_ATTR_NAMES()</span></p>
- </td>
- <td style='width:275pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal;border:none'><span lang=EN>Names of all attributes of the user, as a CSV string</span></p>
- </td>
- <td style='width:225pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoSmaller style='line-height:normal;border:none'><span lang=EN style='font-family:"Courier New"'>allowedSensitiveLevel, allowedSources</span></p>
- </td>
- </tr>
- <tr>
- <td style='width:150pt;border:solid black 1.0pt; border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal;border:none'><span lang=EN>GET_USER_ATTR(attrName)</span></p>
- </td>
- <td style='width:275pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal'><span lang=EN>Value of the given attribute associated with the user</span></p>
- </td>
- <td style='width:225pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoSmaller style='line-height:normal;border:none'><span lang=EN style='font-family:"Courier New"'>10</span></p>
- </td>
- </tr>
- <tr>
- <td style='width:150pt;border:solid black 1.0pt; border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal;border:none'><span lang=EN>HAS_TAG(tagName)</span></p>
- </td>
- <td style='width:275pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal;border:none'><span lang=EN>Is the given tag associated with the resource?</span></p>
- </td>
- <td style='width:225pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'>true</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'>false</span></p>
- </td>
- </tr>
- <tr>
- <td style='width:150pt;border:solid black 1.0pt; border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal;border:none'><span lang=EN>HAS_ANY_TAG</span></p>
- </td>
- <td style='width:275pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal;border:none'><span lang=EN>Is any tag associated with the resource?</span></p>
- </td>
- <td style='width:225pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'>true</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'>false</span></p>
- </td>
- </tr>
- <tr>
- <td style='width:150pt;border:solid black 1.0pt; border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal;border:none'><span lang=EN>HAS_NO_TAG</span></p>
- </td>
- <td style='width:275pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal;border:none'><span lang=EN>Are not tags associated with the resource?</span></p>
- </td>
- <td style='width:225pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'>true</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'>false</span></p>
- </td>
- </tr>
- <tr>
- <td style='width:150pt;border:solid black 1.0pt; border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal;border:none'><span lang=EN>HAS_USER_ATTR(attrName)</span></p>
- </td>
- <td style='width:275pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal;border:none'><span lang=EN>Does the user have the given attribute?</span></p>
- </td>
- <td style='width:225pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoSmaller style='line-height:normal;border:none'><span lang=EN style='font-family:"Courier New"'>true</span></p>
- <p class=MsoSmaller style='line-height:normal;border:none'><span lang=EN style='font-family:"Courier New"'>false</span></p>
- </td>
- </tr>
- <tr>
- <td style='width:150pt;border:solid black 1.0pt; border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal;border:none'><span lang=EN>HAS_UG_ATTR(attrName)</span></p>
- </td>
- <td style='width:275pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal;border:none'><span lang=EN>Does any group associated with the user have the specified attribute?</span></p>
- </td>
- <td style='width:225pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'>true</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'>false</span></p>
- </td>
- </tr>
- <tr>
- <td style='width:150pt;border:solid black 1.0pt; border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal;border:none'><span lang=EN>HAS_TAG_ATTR(attrName)</span></p>
- </td>
- <td style='width:275pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal;border:none'><span lang=EN>Does any tag associated with the resource have the specified attribute?</span></p>
- </td>
- <td style='width:225pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'>true</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'>false</span></p>
- </td>
- </tr>
- <tr>
- <td style='width:150pt;border:solid black 1.0pt; border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal;border:none'><span lang=EN>IS_IN_GROUP(groupName)</span></p>
- </td>
- <td style='width:275pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal;border:none'><span lang=EN>Does the user belong to the specified group?</span></p>
- </td>
- <td style='width:225pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'>true</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'>false</span></p>
- </td>
- </tr>
- <tr>
- <td style='width:150pt;border:solid black 1.0pt; border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal;border:none'><span lang=EN>IS_IN_ROLE(roleName)</span></p>
- </td>
- <td style='width:275pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal;border:none'><span lang=EN>Is the user assigned to the specified role?</span></p>
- </td>
- <td style='width:225pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'>true</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'>false</span></p>
- </td>
- </tr>
- <tr>
- <td style='width:150pt;border:solid black 1.0pt; border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal;border:none'><span lang=EN>IS_IN_ANY_GROUP</span></p>
- </td>
- <td style='width:275pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal;border:none'><span lang=EN>Does the user belong to any group?</span></p>
- </td>
- <td style='width:225pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'>true</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'>false</span></p>
- </td>
- </tr>
- <tr>
- <td style='width:150pt;border:solid black 1.0pt; border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal;border:none'><span lang=EN>IS_IN_ANY_ROLE</span></p>
- </td>
- <td style='width:275pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal;border:none'><span lang=EN>Is any role assigned to the user?</span></p>
- </td>
- <td style='width:225pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'>true</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'>false</span></p>
- </td>
- </tr>
- <tr>
- <td style='width:150pt;border:solid black 1.0pt; border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal;border:none'><span lang=EN>IS_NOT_IN_ANY_GROUP</span></p>
- </td>
- <td style='width:275pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal'><span lang=EN>Does the user belong to no group?</span></p>
- </td>
- <td style='width:225pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'>true</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'>false</span></p>
- </td>
- </tr>
- <tr>
- <td style='width:150pt;border:solid black 1.0pt; border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal;border:none'><span lang=EN>IS_NOT_IN_ANY_ROLE</span></p>
- </td>
- <td style='width:275pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal'><span lang=EN>Is the user associated with no roles?</span></p>
- </td>
- <td style='width:225pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'>true</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'>false</span></p>
- </td>
- </tr>
- <tr>
- <td style='width:150pt;border:solid black 1.0pt; border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal'><span lang=EN>REQ</span></p>
- </td>
- <td style='width:275pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal'><span lang=EN>Request details, as a map</span></p>
- </td>
- <td style='width:225pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'>{</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'> "accessType": "select",</span></p>
- <p class=MsoSmall style='line-height:normal'><span lang=EN style='font-family: "Courier New"'> "clientIPAddress": "10.120.27.49",</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'> "clusterType": "etl",</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'> "clusterName": "etl-e1",</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'> "accessType": "select",</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'> "user": "scott",</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'> "userGroups": [ "g1" ],</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'> "userRoles": [ "r1" ],</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'>}</span></p>
- </td>
- </tr>
- <tr>
- <td style='width:150pt;border:solid black 1.0pt; border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal'><span lang=EN>RES</span></p>
- </td>
- <td style='width:275pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal'><span lang=EN>Resource details, as a map</span></p>
- </td>
- <td style='width:225pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'>{</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'> "database": "db1",</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'> "table": "tbl1",</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'> "Column": "col1",</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'> "_ownerUser": "jane"</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'>}</span></p>
- </td>
- </tr>
- <tr>
- <td style='width:150pt;border:solid black 1.0pt; border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal'><span lang=EN>TAG</span></p>
- </td>
- <td style='width:275pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal'><span lang=EN>Current tag, as a map.</span></p>
- <p class=MsoNormal style='line-height:normal'><span lang=EN>This is available only in tag-based policies.</span></p>
- </td>
- <td style='width:225pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'>{</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'> "_type": "SENSITIVE",</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'> "sensitiveLevel": 10</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'>}</span></p>
- </td>
- </tr>
- <tr>
- <td style='width:150pt;border:solid black 1.0pt; border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal'><span lang=EN>TAGNAMES</span></p>
- </td>
- <td style='width:275pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal'><span lang=EN>Names of tags associated with the resource, as a list </span></p>
- </td>
- <td style='width:225pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'>[ "PII", "SENSITIVE" ]</span></p>
- </td>
- </tr>
- <tr>
- <td style='width:150pt;border:solid black 1.0pt; border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal'><span lang=EN>TAGS</span></p>
- </td>
- <td style='width:275pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal'><span lang=EN>All tags associated with the resource, as a map</span></p>
- </td>
- <td style='width:225pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'>{</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'> "SENSITIVE": {</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'> "_type", "SENSITIVE",</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'> "level": 10</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'> },</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'> "PII": {</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'> "_type", "PII",</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'> "piiType": "email"</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'> }</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'>}</span></p>
- </td>
- </tr>
- <tr>
- <td style='width:150pt;border:solid black 1.0pt; border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal'><span lang=EN>UGNAMES</span></p>
- </td>
- <td style='width:275pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal'><span lang=EN>Names of groups the user belongs to, as a list</span></p>
- </td>
- <td style='width:225pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'>[ "g1" ]</span></p>
- </td>
- </tr>
- <tr>
- <td style='width:150pt;border:solid black 1.0pt; border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal'><span lang=EN>URNAMES</span></p>
- </td>
- <td style='width:275pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal'><span lang=EN>Names of roles the user is assigned to, as a list</span></p>
- </td>
- <td style='width:225pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'>[ "r1" ]</span></p>
- </td>
- </tr>
- <tr>
- <td style='width:150pt;border:solid black 1.0pt; border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal'><span lang=EN>USER</span></p>
- </td>
- <td style='width:275pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoNormal style='line-height:normal'><span lang=EN>Current user</span></p>
- </td>
- <td style='width:225pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt; padding:5.0pt 5.0pt 5.0pt 5.0pt'>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'>{</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'> "_name": "scott",</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'> "allowedSensitiveLevel": 10</span></p>
- <p class=MsoSmaller style='line-height:normal'><span lang=EN style='font-family: "Courier New"'>}</span></p>
- </td>
- </tr>
- </table>
- </div>
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal>
- Most functions listed in the table above take optional parameters, to make it easier to handle use cases that require special handling.
- </p>
-
- <p class=HalfLine> </p>
-
- <h2>Default value</h2>
- <p class=MsoNormal>
- A function call can include a default value as an optional parameter, which will be returned when there is no
- value available. For example, consider the following expression:
- </p>
-
- <p class=MsoNormal> </p>
-
- <span lang=ENG>
- <p class=MsoNormal style='margin-left:1.0in;text-indent:-.25in;font-family:"Courier New"'>USER.allowedSensitiveLevel >= TAG.sensitiveLevel</p>
- <p class=HalfLine> </p>
- </span>
-
- <p class=MsoNormal>
- When the user doesn’t have an attribute named <span lang=EN style='font-family:"Courier New"'>allowedSensitiveLevel</span>, the expression will always evaluate to
- false since <span lang=EN style='font-family:"Courier New"'>USER.allowedSensitiveLevel</span> would evaluate to <span lang=EN style='font-family:"Courier New"'>null</span>. To handle such cases, consider the following
- alternate expression which would use <span lang=EN style='font-family:"Courier New"'>0</span> as the value instead of <span lang=EN style='font-family:"Courier New"'>null</span>:
- </p>
-
- <p class=MsoNormal> </p>
-
- <span lang=ENG>
- <p class=MsoNormal style='margin-left:1.0in;text-indent:-.25in;font-family:"Courier New"'>GET_USER_ATTR('allowedSensitiveLevel', 0) >= TAG.sensitiveLevel</p>
- <p class=HalfLine> </p>
- </span>
-
- <p class=MsoNormal>
- Here is another example of using default value in function calls:
- </p>
-
- <p class=MsoNormal> </p>
-
- <span lang=ENG>
- <p class=MsoNormal style='margin-left:1.0in;text-indent:-.25in;font-family:"Courier New"'>dept_code in (${{GET_UG_ATTR('deptCode', -1)}})</p>
- <p class=HalfLine> </p>
- </span>
-
- <p class=HalfLine> </p>
-
- <h2>Separator</h2>
- <p class=MsoNormal>
- Functions that return a CSV string, like GET_TAG_NAMES(), can include following optional parameters:
- </p>
-
- <span lang=ENG>
- <p class=HalfLine> </p>
- <p class=MsoNormal style='margin-left:0.5in;text-indent:-.25in'>optional #1. default value: value to return when no value is available</p>
- <p class=HalfLine> </p>
- <p class=MsoNormal style='margin-left:0.5in;text-indent:-.25in'>optional #2. separator: string to use as the separator between values</p>
- <p class=HalfLine> </p>
- </span>
-
- <p class=MsoNormal> </p>
- <p class=MsoNormal>
- Here is an example of using optional parameters:
- </p>
-
- <span lang=ENG>
- <p class=HalfLine> </p>
- <p class=MsoNormal style='margin-left:1.0in;text-indent:-.25in;font-family:"Courier New"'>GET_TAG_NAMES('', '|') == 'tag1|tag2|tag3'</p>
- <p class=HalfLine> </p>
- </span>
-
- <h2>Quotes</h2>
- <p class=MsoNormal>
- Each function that returns a CSV string has another version with _Q appended to the function name; this version
- surrounds each value within quotes. For example, consider the following row-filter expression:
- </p>
-
- <span lang=ENG>
- <p class=HalfLine> </p>
- <p class=MsoNormal style='margin-left:1.0in;text-indent:-.25in;font-family:"Courier New"'>location_state IN (${{GET_UG_ATTR_Q('state')}})</p>
- <p class=HalfLine> </p>
- </span>
-
- <p class=MsoNormal> </p>
- <p class=MsoNormal>
- The expression can evaluate to the following, if the user belongs to groups having an attribute named state:
- </p>
-
- <span lang=ENG>
- <p class=HalfLine> </p>
- <p class=MsoNormal style='margin-left:1.0in;text-indent:-.25in;font-family:"Courier New"'>location_state IN ('CA','OR','WA')</p>
- <p class=HalfLine> </p>
- </span>
-
-</div>
-</body>
-
-<footer>
- <div align=center>
- <a href="/blogs.html">Apache Ranger™ blogs</a>
- </div>
-</footer>
-</html>
diff --git a/docs/src/site/resources/blogs/integrating_applications.html b/docs/src/site/resources/blogs/integrating_applications.html
deleted file mode 100644
index 39590c457..000000000
--- a/docs/src/site/resources/blogs/integrating_applications.html
+++ /dev/null
@@ -1,828 +0,0 @@
-<!--
- Licensed to the Apache Software Foundation (ASF) under one or more
- contributor license agreements. See the NOTICE file distributed with
- this work for additional information regarding copyright ownership.
- The ASF licenses this file to You under the Apache License, Version 2.0
- (the "License"); you may not use this file except in compliance with
- the License. You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
--->
-<!DOCTYPE html>
-<html lang="en">
-
- <head>
- <meta http-equiv=Content-Type content="text/html; charset=utf-8">
- <title>Integrating Applications with Apache Ranger</title>
- <style>
- <!--
- /* Font Definitions */
- @font-face {font-family:Wingdings; panose-1:5 0 0 0 0 0 0 0 0 0;}
- @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;}
- @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;}
- @font-face {font-family:"Calibri Light"; panose-1:2 15 3 2 2 2 4 3 2 4;}
-
- /* Style Definitions */
- p.MsoNormal, li.MsoNormal, div.MsoNormal
- {margin:0in; font-size:12.0pt; font-family:"Calibri",sans-serif;}
- pre.CodeBlock
- {margin:0.12in 0.2in; padding:0.12in 0.14in; font-size:9.5pt; font-family:"Courier New",monospace;
- line-height:1.35; background:#F3F3F3; border:1px solid windowtext; border-radius:4px;
- white-space:pre-wrap; word-wrap:break-word; overflow-x:auto; tab-size:4;}
- div.WordSection img
- {border:1px solid windowtext;}
- h1
- {mso-style-link:"Heading 1 Char"; margin-top:12.0pt; margin-right:0in; margin-bottom:0in; margin-left:0in; page-break-after:avoid; font-size:16.0pt; font-family:"Calibri Light",sans-serif; color:#2F5496; font-weight:normal;}
- h2
- {mso-style-link:"Heading 1 Char"; margin-top:10.0pt; margin-right:0in; margin-bottom:0in; margin-left:0in; page-break-after:avoid; font-size:14.0pt; font-family:"Calibri Light",sans-serif; color:#2F5496; font-weight:normal;}
- h3
- {mso-style-link:"Heading 1 Char"; margin-top:8.0pt; margin-right:0in; margin-bottom:0in; margin-left:0in; page-break-after:avoid; font-size:13.0pt; font-family:"Calibri Light",sans-serif; color:#2F5496; font-weight:normal;}
-
- p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
- {margin-top:0in; margin-right:0in; margin-bottom:0in; margin-left:.5in; font-size:12.0pt; font-family:"Calibri",sans-serif;}
- p.MsoListParagraphCxSpFirst, li.MsoListParagraphCxSpFirst, div.MsoListParagraphCxSpFirst
- {margin-top:0in; margin-right:0in; margin-bottom:0in; margin-left:.5in; font-size:12.0pt; font-family:"Calibri",sans-serif;}
- p.MsoListParagraphCxSpMiddle, li.MsoListParagraphCxSpMiddle, div.MsoListParagraphCxSpMiddle
- {margin-top:0in; margin-right:0in; margin-bottom:0in; margin-left:.5in; font-size:12.0pt; font-family:"Calibri",sans-serif;}
- p.MsoListParagraphCxSpLast, li.MsoListParagraphCxSpLast, div.MsoListParagraphCxSpLast
- {margin-top:0in; margin-right:0in; margin-bottom:0in; margin-left:.5in; font-size:12.0pt; font-family:"Calibri",sans-serif;}
- span.Heading1Char
- {mso-style-name:"Heading 1 Char"; mso-style-link:"Heading 1"; font-family:"Calibri Light",sans-serif; color:#2F5496;}
- span.FootnoteTextChar
- {mso-style-name:"Footnote Text Char"; mso-style-link:"Footnote Text";}
- .MsoChpDefault
- {font-family:"Calibri",sans-serif;}
-
- /* Page Definitions */
- @page WordSection1
- {size:8.5in 11.0in; margin:1.0in 1.0in 1.0in 1.0in;}
- div.WordSection1
- {page:WordSection1;}
-
-
- /* List Definitions */
- ol
- {margin-bottom:0in;}
- ul
- {margin-bottom:0in;}
- -->
- </style>
- </head>
-
- <body lang=EN-US style='width:800px;word-wrap:break-word;align:center;margin:auto;border:ridge' >
- <div style="margin-left:10pt;margin-right:10pt">
- <h1 style="text-align:center">Integrating Applications with Apache Ranger</h1>
- <p class=MsoNormal style='font:5.0pt "Times New Roman"'> </p>
- <div style="text-align:center">
- <p class=MsoNormal>Madhan Neethiraj, Apache Ranger committer</p>
- <p class=MsoNormal>Aug 24, 2026</p>
- </div>
- <p class=MsoNormal> </p>
-
- <div class=WordSection>
- <h1>Introduction</h1>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>
- Apache Ranger provides a centralized framework for managing authorization policies and controlling access to resources in services such as HDFS, Ozone, HMS, Hive, Impala, Kafka, Solr, KMS, Atlas, Trino and Polaris. Enterprises use Ranger to address their data access governance needs, access auditing, delegated policy management by business users through an intuitive UI. This guide describes how an application can integrate with Apache Ranger to authorize access to its resources.
- </p>
- <p class=MsoNormal> </p>
-
- <h2>Contents</h2>
- <p class=MsoNormal> </p>
- <p class=MsoNormal><a href="#s1">1. Apache Ranger</a></p>
- <p class=MsoNormal><a href="#s2">2. Integration: Overview</a></p>
- <p class=MsoNormal><a href="#s3">3. Integration: Service Definition</a></p>
- <p class=MsoNormal><a href="#s4">4. Integration: Plugin</a></p>
- <p class=MsoNormal><a href="#s5">5. Integration: PDP Server</a></p>
- <p class=MsoNormal><a href="#s6">6. Policy Administration</a></p>
- <p class=MsoNormal><a href="#references">References</a></p>
- <p class=MsoNormal> </p>
-
- <h1 id="s1">1. Apache Ranger</h1>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>
- Apache Ranger provides policy-based authorization for resources managed by applications. An application submits an authorization request identifying the user, resource, and requested access. Ranger evaluates the request against the applicable policies and returns an authorization decision.
- </p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>
- Apache Ranger provides centralized policy administration through APIs and UI. Policies can be managed by Ranger administrators, designated administrators for each application and users delegated to manage policies for a limited resource scope.
- </p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>
- Apache Ranger can audit access requests and authorization decisions. Audit records can include information such as the user, resource, requested access, authorization result, and request context.
- </p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>
- Apache Ranger policies can control access based on:
- </p>
- <p class=MsoNormal> </p>
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'>1.<span style='font:7.0pt "Times New Roman"'> </span>resource names and resource hierarchies.</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>2.<span style='font:7.0pt "Times New Roman"'> </span>tags associated with resources.</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>3.<span style='font:7.0pt "Times New Roman"'> </span>attributes and groups associated with users.</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>4.<span style='font:7.0pt "Times New Roman"'> </span>attributes associated with resources.</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>5.<span style='font:7.0pt "Times New Roman"'> </span>request context and policy conditions.</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>
- Apache Ranger supports several types of data-access policies:
- </p>
- <p class=MsoNormal> </p>
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'>1.<span style='font:7.0pt "Times New Roman"'> </span>Access policies determine whether a user is allowed or denied access to a resource.</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>2.<span style='font:7.0pt "Times New Roman"'> </span>Data masking policies determine how data should be masked when returned to an authorized user.</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>3.<span style='font:7.0pt "Times New Roman"'> </span>Row-filtering policies determine which rows of a dataset are visible to a user.</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>
- The application is responsible for enforcing the authorization, masking, and filtering decisions returned by Ranger. For more on Ranger policy concepts, see the <a href="policy_model.html">Apache Ranger Policy Model</a> blog.
- </p>
- <p class=MsoNormal> </p>
- <h1 id="s2">2. Integration: Overview</h1>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>
- An application integrates with Ranger in three basic steps:
- </p>
- <p class=MsoNormal> </p>
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'>1.<span style='font:7.0pt "Times New Roman"'> </span>Register the application’s authorization model with Ranger.</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>2.<span style='font:7.0pt "Times New Roman"'> </span>Request authorization decisions from Ranger.</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>3.<span style='font:7.0pt "Times New Roman"'> </span>Enforce the decisions returned by Ranger.</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>
- The application’s authorization model is represented by a Ranger service definition. A service definition describes the resources protected by the application, the access types that can be authorized, and optional data-masking and row-filtering capabilities. Ranger’s service-definition model includes resources, access types, service configurations, context enrichers, custom conditions, data-mask definitions, and row-filter definitions.
- </p>
- <h2>2.1 Register Application’s Service Definition</h2>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>The application defines its authorization model using a Ranger service definition.</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>The service definition describes:</p>
- <p class=MsoNormal> </p>
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>resources</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>access types</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>data-masking capabilities</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>row-filtering capabilities</p>
- <p class=MsoListParagraphCxSpLast style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>service configuration properties</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>A service definition can be registered and managed through Apache Ranger’s service-definition APIs. Apache Ranger exposes APIs for creating, retrieving, updating, and deleting service definitions.</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>For example, an application managing datasets might define:</p>
- <p class=MsoNormal> </p>
- <pre class=CodeBlock>Resources:
- catalog
- database
- table
- column
-
-Access types:
- create
- alter
- drop
- select
- update
- </pre>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Once the service definition is registered, administrators can create policies using these resources and access types.</p>
- <p class=MsoNormal> </p>
- <h2>2.2 Request Authorization Decisions</h2>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>An application can obtain authorization decisions using either a Ranger plugin or the Ranger PDP APIs.</p>
- <p class=MsoNormal> </p>
- <h3>Ranger Plugin</h3>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Ranger plugin integration approach is typically used by Java applications. The plugin is embedded in the application and evaluates authorization requests locally using policies obtained from Ranger admin server. The plugin can generate audit events that are delivered to configured audit destinations.</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal align=center style='text-align:center'>
- <img width=780 height=259 src="integrating_applications.files/image1.png" alt="Fig 1. Apache Ranger embedded plugin authorization flow">
- </p>
- <p class=MsoNormal align=center style='text-align:center'>Fig 1. Apache Ranger embedded plugin authorization flow</p>
- <p class=MsoNormal> </p>
- <h3>Ranger PDP</h3>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Apache Ranger PDP server provides authorization service that applications can invoke through REST APIs. This integration approach is suitable for:</p>
- <p class=MsoNormal> </p>
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>non-Java applications</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>applications that do not want to embed Ranger libraries</p>
- <p class=MsoListParagraphCxSpLast style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>applications requiring a smaller client-side footprint</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal align=center style='text-align:center'>
- <img width=780 height=231 src="integrating_applications.files/image2.png" alt="Fig 2. Apache Ranger PDP server authorization flow">
- </p>
- <p class=MsoNormal align=center style='text-align:center'>Fig 2. Apache Ranger PDP server authorization flow</p>
- <p class=MsoNormal> </p>
- <h2>2.3 Enforce the Authorization Decision</h2>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Ranger returns an authorization decision; it does not enforce the decision on behalf of the application. The application must ensure that a denied request does not proceed.</p>
- <p class=MsoNormal> </p>
- <h1 id="s3">3. Integration: Service Definition</h1>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>A Ranger service definition describes the authorization model exposed by an application or service. It tells Ranger what resources can be protected, what operations can be authorized, and what additional authorization capabilities the service supports.</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>The primary Java model is <a href="https://github.com/apache/ranger/blob/release-ranger-2.9.0/agents-common/src/main/java/org/apache/ranger/plugin/model/RangerServiceDef.java">RangerServiceDef</a>, containing definitions for resources, access types, service configurations, context enrichers, custom conditions, data masking, and row filtering. A service definition can be registered with Apache Ranger using the service-definition APIs. Ranger provides REST APIs t [...]
- <p class=MsoNormal> </p>
- <p class=MsoNormal>A good way to design a service definition is to start with the application’s authorization model and then map that model to Apache Ranger concepts.</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Refer to following service-definitions for existing integrations, in JSON files, for details of available options:</p>
- <p class=MsoNormal> </p>
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span><a href="https://github.com/apache/ranger/blob/master/agents-common/src/main/resources/service-defs/ranger-servicedef-hdfs.json">HDFS</a></p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span><a href="https://github.com/apache/ranger/blob/master/agents-common/src/main/resources/service-defs/ranger-servicedef-ozone.json">Ozone</a></p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span><a href="https://github.com/apache/ranger/blob/master/agents-common/src/main/resources/service-defs/ranger-servicedef-hive.json">Hive</a></p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span><a href="https://github.com/apache/ranger/blob/master/agents-common/src/main/resources/service-defs/ranger-servicedef-trino.json">Trino</a></p>
- <p class=MsoListParagraphCxSpLast style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span><a href="https://github.com/apache/ranger/blob/master/agents-common/src/main/resources/service-defs/ranger-servicedef-polaris.json">Polaris</a></p>
- <p class=MsoNormal> </p>
- <h2>3.1 Resources</h2>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>A resource definition identifies a resource that can appear in a Ranger policy. For example, here are few resources in Apache Hive service definition:</p>
- <p class=MsoNormal> </p>
- <pre class=CodeBlock>"resources": [
- {
- "itemId": 1,
- "name": "database",
- "parent": "",
- "matcherOptions": { "wildCard": true, "ignoreCase": true },
- "label": "Hive Database",
- "isValidLeaf": true
- },
- {
- "itemId": 2,
- "name": "table",
- "parent": "database",
- "matcherOptions": { "wildCard": true, "ignoreCase": true },
- "label": "Hive Table",
- "isValidLeaf": true
- },
- {
- "itemId": 3,
- "name": "column",
- "parent": "table",
- "matcherOptions": { "wildCard": true, "ignoreCase": true },
- "label": "Hive Column",
- "isValidLeaf": true
- }
-]</pre>
- <p class=MsoNormal> </p>
- <h2>3.2 Access Types</h2>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Access types define the operations that can appear in a Ranger policy. For example, here are few access types in Apache Hive service definition:</p>
- <p class=MsoNormal> </p>
- <pre class=CodeBlock>"accessTypes": [
- { "itemId": 1, "name": "select", "label": "Select" },
- { "itemId": 2, "name": "update", "label": "Update" },
- { "itemId": 3, "name": "create", "label": "Create" },
- { "itemId": 4, "name": "drop", "label": "Drop" },
- { "itemId": 5, "name": "alter", "label": "Alter" },
- { "itemId": 6, "name": "all", "label": "All",
- "impliedGrants": [ "select", "update", "create", "drop", "alter" ]
- }
-]</pre>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>impliedGrants enable grouping of multiple accessTypes with a logical name, such as all in the example above. Reference to an accessTypes in policies are equivalent to referencing all its impliedGrants.</p>
- <p class=MsoNormal> </p>
- <h2>3.3 Data Masking</h2>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>A service can expose data-masking capabilities through the dataMaskDef section in its service definition. This section defines:</p>
- <p class=MsoNormal> </p>
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>resources to which masking can apply</p>
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>supported mask types</p>
- <p class=MsoListParagraphCxSpLast style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>access types for which masking is relevant</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>For example, here is a sample dataMaskDef section from Apache Hive service definition:</p>
- <p class=MsoNormal> </p>
- <pre class=CodeBlock>"dataMaskDef": {
- "resources": [
- {
- "name": "database",
- "matcherOptions": { "wildCard": "false" },
- "uiHint": "{ \"singleValue\":true }"
- },
- {
- "name": "table",
- "matcherOptions": { "wildCard": "false" },
- "uiHint": "{ \"singleValue\":true }"
- },
- {
- "name": "column",
- "matcherOptions": { "wildCard": "false" },
- "uiHint": "{ \"singleValue\":true }"
- }
- ],
- "maskTypes": [
- {
- "itemId": 1,
- "name": "MASK",
- "label": "Redact",
- "transformer": "mask({col})"
- },
- {
- "itemId": 2,
- "name": "MASK_SHOW_LAST_4",
- "label": "Partial mask: show last 4",
- "transformer": "mask_show_last_n({col}, 4, 'x', 'x', 'x', -1, '1')"
- },
- {
- "itemId": 3,
- "name": "MASK_SHOW_FIRST_4",
- "label": "Partial mask: show first 4",
- "transformer": "mask_show_first_n({col}, 4, 'x', 'x', 'x', -1, '1')"
- },
- {
- "itemId": 4,
- "name": "MASK_HASH",
- "label": "Hash",
- "transformer": "mask_hash({col})"
- },
- {
- "itemId": 5,
- "name": "MASK_DATE_SHOW_YEAR",
- "label": "Date: show only year",
- "transformer": "mask({col}, 'x', 'x', 'x', -1, '1', 1, 0, -1)"
- },
- {
- "itemId": 6,
- "name": "MASK_NULL",
- "label": "Nullify"
- },
- {
- "itemId": 7,
- "name": "MASK_NONE",
- "label": "Unmasked (retain original value)"
- },
- {
- "itemId": 8,
- "name": "CUSTOM",
- "label": "Custom"
- }
- ],
- "accessTypes": [
- { "name": "select" }
- ]
-}</pre>
- <p class=MsoNormal> </p>
- <h2>3.4 Row Filtering</h2>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>A service can expose row-filtering capabilities through the rowFilterDef section in its service definition. This section defines:</p>
- <p class=MsoNormal> </p>
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>Resources to which row-filtering can apply</p>
- <p class=MsoListParagraphCxSpLast style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>Access types for which row-filtering is relevant</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>For example, here is a sample rowFilterDef section from Apache Hive service definition:</p>
- <p class=MsoNormal> </p>
- <pre class=CodeBlock>"rowFilterDef": {
- "resources": [
- {
- "name": "database",
- "matcherOptions": { "wildCard": "false" },
- "uiHint": "{ \"singleValue\":true }"
- },
- {
- "name": "table",
- "matcherOptions": { "wildCard": "false" },
- "uiHint": "{ \"singleValue\":true }"
- }
- ],
- "accessTypes": [
- { "name": "select" }
- ]
-}</pre>
- <p class=MsoNormal> </p>
- <h2>3.5 Service Configurations</h2>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>A service definition can define configuration properties required to lookup resources in the application, for auto-completion in policy UI as users enter resource values. These configurations include the endpoint (JDBC, HTTP, ..) the application can be reached at, credentials to use while connecting to the application.</p>
- <p class=MsoNormal> </p>
- <pre class=CodeBlock>"configs": [
- {
- "itemId": 1,
- "name": "username",
- "type": "string",
- "mandatory": true,
- "label": "Username"
- },
- {
- "itemId": 2,
- "name": "password",
- "type": "password",
- "mandatory": true,
- "label": "Password"
- },
- {
- "itemId": 3,
- "name": "jdbc.driverClassName",
- "type": "string",
- "mandatory": true,
- "defaultValue": "org.apache.hive.jdbc.HiveDriver"
- },
- {
- "itemId": 4,
- "name": "jdbc.url",
- "type": "string",
- "mandatory": true,
- "defaultValue": ""
- }
-]</pre>
- <p class=MsoNormal> </p>
- <h1 id="s4">4. Integration: Plugin</h1>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Ranger plugin is the preferred integration mechanism for Java applications that want to perform authorization locally i.e. in-process. The core APIs, including following classes, are provided by Ranger libraries <a href="https://mvnrepository.com/artifact/org.apache.ranger/ranger-authz-api">org.apache.ranger:ranger-authz-api</a> and <a href="https://mvnrepository.com/artifact/org.apache.ranger/authz-embedded">org.apache.ranger:authz-embedded</a>.</p>
- <p class=MsoNormal> </p>
- <pre class=CodeBlock>org.apache.ranger.authz.api.RangerAuthorizer
-org.apache.ranger.authz.embedded.RangerEmbeddedAuthorizer
-org.apache.ranger.authz.model.RangerAccessContext
-org.apache.ranger.authz.model.RangerAccessInfo
-org.apache.ranger.authz.model.RangerAuthzRequest
-org.apache.ranger.authz.model.RangerAuthzResult
-org.apache.ranger.authz.model.RangerAuthzResult.AccessDecision
-org.apache.ranger.authz.model.RangerUserInfo</pre>
- <p class=MsoNormal> </p>
- <h2>4.1 Initializing the Plugin</h2>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Ranger plugin instance is typically created and initialized during initialization of the application. Here is an example of Polaris plugin initialization:</p>
- <p class=MsoNormal> </p>
- <pre class=CodeBlock>RangerAuthorizer authorizer = new RangerEmbeddedAuthorizer(properties);
-authorizer.init();</pre>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Ranger plugin downloads policies from Ranger admin server during initialization, builds a policy engine in-memory for faster evaluation. The plugin periodically polls the Ranger admin server, asynchronously, for any policy changes and keeps its policy engine updated.</p>
- <p class=MsoNormal> </p>
- <h2>4.2 Creating an Authorization Request</h2>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>The application converts its native access request into a Ranger authorization request. For example:</p>
- <p class=MsoNormal> </p>
- <pre class=CodeBlock>String table = "table:sales/customers/accounts";
-RangerUserInfo user = new RangerUserInfo("alice");
-RangerAccessInfo access = new RangerAccessInfo(table, "QUERY", "select");
-RangerAccessContext ctx = new RangerAccessContext("trino", "sales_trino");
-RangerAuthzRequest request = new RangerAuthzRequest(user, access, ctx);</pre>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Notes:</p>
- <p class=MsoNormal> </p>
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span><samp>alice</samp>, the username referenced must represent the authenticated caller of the application.</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span><samp>trino</samp>, the serviceType referenced is the name of the service-definition registered with Ranger.</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span><samp>select</samp>, the permission referenced must be one of accessTypes in the service-definition.</p>
- <p class=MsoListParagraphCxSpLast style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span><samp>sales_trino</samp>, the serviceName referenced represents a deployment of the Trino application. Remember, Ranger can support multiple deployments of an application type, such as <samp>marketing_trino</samp>, <samp>support_trino</samp>, <samp>test_trino</samp> - each with a different set of poli [...]
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Additional information can be included in the authorization request, for example:</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Context can include the following:</p>
- <p class=MsoNormal> </p>
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>client IP</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>client type</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>request time</p>
- <p class=MsoListParagraphCxSpLast style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>cluster name</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>User can include the following:</p>
- <p class=MsoNormal> </p>
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>groups the user belongs to</p>
- <p class=MsoListParagraphCxSpLast style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>user attributes, like department, location</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Resource can include the following:</p>
- <p class=MsoNormal> </p>
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>subResources, such as column names</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>resource attributes, such as OWNER</p>
- <p class=MsoListParagraphCxSpLast style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>matchingScope, such as SELF, SELF_OR_ANY_CHILD, SELF_OR_ANY_DESCENDANT</p>
- <p class=MsoNormal> </p>
- <h2>4.3 Evaluating the Request</h2>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>The plugin evaluates the request:</p>
- <p class=MsoNormal> </p>
- <pre class=CodeBlock>RangerAuthzResult result = authorizer.authorize(request);</pre>
- <p class=MsoNormal>The result contains the authorization decision and additional information that can be used by the application or audit subsystem.</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>When the result doesn’t allow the requested access, applications should treat it as an authorization failure and must enforce that decision before accessing the protected resource.</p>
- <p class=MsoNormal> </p>
- <pre class=CodeBlock>if (!AccessDecision.ALLOW.equals(result.getDecision())) {
- throw new AccessDeniedException();
-}</pre>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>When the result includes masking and/or row-filter expression, the application must include these into the query before executing.</p>
- <p class=MsoNormal> </p>
- <pre class=CodeBlock>RowFilterResult rowFilter = result.getPermissions("select").getRowFilter();
-if (rowFilter != null && StringUtils.isNotBlank(rowFilter.getFilterExpr())) {
- // application must include the returned filter expression into the query
-}
-DataMaskResult dataMask = result.getPermissions("select").getDataMask();
-if (dataMask != null && StringUtils.isNotBlank(dataMask.getMaskType())) {
- // application must apply the returned data mask expression into the query
-}</pre>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>authorize() method is thread-safe, hence can be called from multiple threads simultaneously.</p>
- <p class=MsoNormal> </p>
- <h2>4.4 Plugin Configuration</h2>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Ranger plugin requires configuration identifying:</p>
- <p class=MsoNormal> </p>
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>Ranger Admin endpoint</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>Policy refresh settings</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>Authentication configuration</p>
- <p class=MsoListParagraphCxSpLast style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>Audit configuration</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Depending on the Ranger version and deployment configuration, the plugin's Ranger Admin client can use authentication mechanisms such as Basic authentication, JWT, or Kerberos, together with SSL/TLS.</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>A typical deployment would include following configurations:</p>
- <p class=MsoNormal> </p>
- <pre class=CodeBlock>ranger.authz.service.sales_trino.policy.rest.url=https://ranger.example.com
-ranger.authz.service.sales_trino.policy.pollIntervalMs=30000
-ranger.authz.service.sales_trino.policy.cache.dir=/etc/trino/policy_cache
-# Choose the authentication mechanism appropriate for the deployment
-# Basic authentication
-ranger.authz.service.sales_trino.policy.rest.client.username=
-ranger.authz.service.sales_trino.policy.rest.client.password=</pre>
- <p class=MsoNormal> </p>
- <pre class=CodeBlock># JWT authentication
-ranger.authz.service.sales_trino.policy.rest.client.jwt.source=env|file|cred
-ranger.authz.service.sales_trino.policy.rest.client.jwt.env=TRINO_JWT
-ranger.authz.service.sales_trino.policy.rest.client.jwt.file=/etc/trino/trino.jwt
-ranger.authz.service.sales_trino.policy.rest.client.jwt.cred.file=
-ranger.authz.service.sales_trino.policy.rest.client.jwt.cred.alias=
-# Kerberos authentication
-ranger.authz.service.sales_trino.ugi.initialize=true
-ranger.authz.service.sales_trino.ugi.login.type=keytab
-ranger.authz.service.sales_trino.ugi.keytab.principal=trino@MYDOMAIN.COM
-ranger.authz.service.sales_trino.ugi.keytab.file=/etc/keytabs/trino.keytab</pre>
- <p class=MsoNormal> </p>
- <pre class=CodeBlock># audit configuration
-ranger.authz.audit.is.enabled=true
-ranger.authz.audit.destination.solr=true
-ranger.authz.audit.destination.solr.urls=
-ranger.authz.audit.destination.hdfs=true
-ranger.authz.audit.destination.hdfs.dir=</pre>
- <p class=MsoNormal> </p>
- <h2>4.5 Existing Authorizer Implementations</h2>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Several complete authorizer implementations are available in Apache Ranger repository and other application repositories. Here are a few that can be good references for anyone looking to use the Ranger plugin approach.</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>API version note: Apache Ranger currently has two integration patterns in use. The newer authorization API introduced in Apache Ranger 2.9.0 uses authz-api/authz-embedded API shown in this guide. Polaris authorizer implementation uses this new API. Many existing Ranger plugins, including HDFS, Hive, HBase, Kafka, and Ozone, use the older ranger-plugins-common/RangerBasePlugin API.</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>For new integrations, use the authorization API appropriate to the Ranger version being integrated with. The examples in this guide use the newer authz-api/authz-embedded API.</p>
- <p class=MsoNormal> </p>
- <table class=MsoTableGrid border=1 cellspacing=0 cellpadding=0 style='margin-left:30.35pt;border-collapse:collapse;border:none'>
- <tr>
- <td valign=top style='border:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;text-align:center'><p class=MsoNormal><b>Application</b></p></td>
- <td valign=top style='border-top:solid windowtext 1.0pt;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;text-align:center'><p class=MsoNormal><b>Implementation Classes</b></p></td>
- <td valign=top style='border-top:solid windowtext 1.0pt;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;text-align:center'><p class=MsoNormal><b>Notes</b></p></td>
- </tr>
- <tr>
- <td valign=top style='border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Polaris</p></td>
- <td valign=top style='border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><a href="https://github.com/apache/polaris/blob/main/extensions/auth/ranger/src/main/java/org/apache/polaris/extension/auth/ranger/RangerPolarisAuthorizer.java">RangerPolarisAuthorizer</a></p></td>
- <td valign=top style='border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Iceberg catalog authorization</p></td>
- </tr>
- <tr>
- <td valign=top style='border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Trino</p></td>
- <td valign=top style='border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><a href="https://github.com/trinodb/trino/blob/master/plugin/trino-ranger/src/main/java/io/trino/plugin/ranger/RangerSystemAccessControl.java">RangerSystemAccessControl</a></p></td>
- <td valign=top style='border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>SQL engine authorization, column-masking, row-filtering</p></td>
- </tr>
- <tr>
- <td valign=top style='border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>HDFS</p></td>
- <td valign=top style='border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><a href="https://github.com/apache/ranger/blob/master/hdfs-agent/src/main/java/org/apache/ranger/authorization/hadoop/RangerHdfsAuthorizer.java">RangerHdfsAuthorizer</a></p></td>
- <td valign=top style='border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Authorize access to path resources</p></td>
- </tr>
- <tr>
- <td valign=top style='border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Ozone</p></td>
- <td valign=top style='border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><a href="https://github.com/apache/ranger/blob/master/plugin-ozone/src/main/java/org/apache/ranger/authorization/ozone/authorizer/RangerOzoneAuthorizer.java">RangerOzoneAuthorizer</a></p></td>
- <td valign=top style='border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Relatively compact RangerBasePlugin integration</p></td>
- </tr>
- <tr>
- <td valign=top style='border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Hive</p></td>
- <td valign=top style='border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><a href="https://github.com/apache/ranger/blob/master/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizer.java">RangerHiveAuthorizer</a></p></td>
- <td valign=top style='border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Authorize access to hierarchical resources, resource filtering, column masking, row filtering</p></td>
- </tr>
- <tr>
- <td valign=top style='border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>HBase</p></td>
- <td valign=top style='border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><a href="https://github.com/apache/ranger/blob/master/hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessor.java">RangerAuthorizationCoprocessor</a></p></td>
- <td valign=top style='border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Authorize access to columnar data</p></td>
- </tr>
- <tr>
- <td valign=top style='border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Kafka</p></td>
- <td valign=top style='border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><a href="https://github.com/apache/ranger/blob/master/plugin-kafka/src/main/java/org/apache/ranger/authorization/kafka/authorizer/RangerKafkaAuthorizer.java">RangerKafkaAuthorizer</a></p></td>
- <td valign=top style='border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Authorize event streaming in Kafka</p></td>
- </tr>
- </table>
- <p class=MsoNormal> </p>
- <h1 id="s5">5. Integration: PDP Server</h1>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Ranger PDP server provides a remote authorization model, using REST APIs, for applications that can’t or don’t prefer embedding a Ranger authorizer. For example:</p>
- <p class=MsoNormal> </p>
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>The application is not written in Java.</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>Embedding Ranger plugin Java libraries is undesirable or not feasible.</p>
- <p class=MsoListParagraphCxSpLast style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>A small client-side footprint is preferred.</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>The tradeoff is that each authorization request involves communication with the Ranger PDP server via REST APIs. Applications should therefore consider latency, availability, connection management, and timeout behavior. Unlike embedded plugin authorization, remote authorization introduces a network dependency into the authorization path. An application must define how it behaves when the PDP is unavailable or a request times out.</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>A PDP communication failure is not an authorization decision. Applications should not treat failure to obtain a decision as an implicit allow. For protected operations, a fail-closed approach is generally appropriate unless the application has an explicitly designed alternative.</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Applications can use the supported PDP APIs appropriate to their implementation language.</p>
- <p class=MsoNormal> </p>
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>A non-Java application can use the REST APIs defined in <a href="https://github.com/apache/ranger/blob/master/pdp/src/main/java/org/apache/ranger/pdp/rest/RangerPdpREST.java">RangerPdpREST</a> directly.</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>Java applications can use Java APIs in <a href="https://mvnrepository.com/artifact/org.apache.ranger/authz-remote">org.apache.ranger:authz-remote</a> library.</p>
- <p class=MsoListParagraphCxSpLast style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>Python applications can use Python APIs in <a href="https://pypi.org/project/apache-ranger/">apache-ranger</a> library.</p>
- <p class=MsoNormal> </p>
- <h2>5.1 PDP REST APIs</h2>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Applications that prefer a minimal footprint in using Ranger policies to authorize access should consider directly calling REST APIs provided by Ranger PDP server. The PDP request contains essentially the same authorization information used by the embedded plugin:</p>
- <p class=MsoNormal> </p>
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>user</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>resource</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>permissions (access types defined in service definitions)</p>
- <p class=MsoListParagraphCxSpLast style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>context</p>
- <p class=MsoNormal> </p>
- <pre class=CodeBlock>For example:
-POST /v1/authorize
-{
- "user": { "name": "alice" },
- "access": {
- "resource": { "name": "table:sales/customers/accounts" },
- "action": "QUERY",
- "permissions": [ "select" ]
- },
- "context": {
- "serviceType": "trino",
- "serviceName": "sales_trino"
- }
-}</pre>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Response:</p>
- <p class=MsoNormal> </p>
- <pre class=CodeBlock>{
- "decision": "ALLOW"
-}</pre>
- <p class=MsoNormal>Ranger PDP server evaluates the request against the applicable Ranger policies and returns the authorization result. The exact wire format should follow the PDP API supported by the Ranger version being deployed.</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Note that only trusted users, as configured in PDP server, are allowed the following:</p>
- <p class=MsoNormal> </p>
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'>1.<span style='font:7.0pt "Times New Roman"'> </span>authorize for other users i.e, "user.name" is different from the caller</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>2.<span style='font:7.0pt "Times New Roman"'> </span>provide groups the user belongs to</p>
- <p class=MsoListParagraphCxSpLast style='text-indent:-.25in'>3.<span style='font:7.0pt "Times New Roman"'> </span>provide attributes of the user or the resource</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>This distinction is important because the PDP server must not blindly trust a caller to assert another user's identity, groups, or attributes. Such fields should only be accepted from callers that are explicitly trusted by the PDP configuration.</p>
- <p class=MsoNormal> </p>
- <h2>5.2 PDP Java APIs</h2>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Ranger PDP client Java APIs provide convenient wrappers over corresponding Ranger PDP REST APIs. These are provided by libraries <a href="https://mvnrepository.com/artifact/org.apache.ranger/ranger-authz-api">org.apache.ranger:ranger-authz-api</a> and <a href="https://mvnrepository.com/artifact/org.apache.ranger/authz-remote">org.apache.ranger:authz-remote</a>.</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>These APIs look very similar to the APIs used in plugin integration detailed earlier - except for the authorizer initialization, as seen in the example below:</p>
- <p class=MsoNormal> </p>
- <pre class=CodeBlock>// initialize once during application startup
-RangerAuthorizer authorizer = new RangerRemoteAuthorizer(properties);</pre>
- <p class=MsoNormal> </p>
- <pre class=CodeBlock>authorizer.init();</pre>
- <p class=MsoNormal> </p>
- <pre class=CodeBlock>// authorize an access
-String table = "table:sales/customers/accounts";
-RangerUserInfo user = new RangerUserInfo("alice");
-RangerAccessInfo access = new RangerAccessInfo(table, "QUERY", "select");
-RangerAccessContext ctx = new RangerAccessContext("trino", "sales_trino");
-
-RangerAuthzRequest request = new RangerAuthzRequest(user, access, ctx);
-
-RangerAuthzResult result = authorizer.authorize(request);</pre>
- <p class=MsoNormal> </p>
- <pre class=CodeBlock>if (!AccessDecision.ALLOW.equals(result.getDecision())) {
- throw new AccessDeniedException();
-}
-
-RowFilterResult rowFilter = result.getPermissions("select").getRowFilter();
-
-if (rowFilter != null && StringUtils.isNotBlank(rowFilter.getFilterExpr())) {
- // application must include the returned filter expression into the query
-}
-
-DataMaskResult dataMask = result.getPermissions("select").getDataMask();
-
-if (dataMask != null && StringUtils.isNotBlank(dataMask.getMaskType())) {
- // application must apply the returned data mask expression into the query
-}</pre>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Configurations to connect to Ranger PDP server, including authentication details, must be populated in properties referenced above:</p>
- <p class=MsoNormal> </p>
- <pre class=CodeBlock>ranger.authz.remote.pdp.url=https://ranger-pdp.example.com
-ranger.authz.remote.authn.type=jwt|kerberos|header
-ranger.authz.remote.authn.jwt.source=
-ranger.authz.remote.authn.jwt.env=
-ranger.authz.remote.authn.kerberos.principal=
-ranger.authz.remote.authn.kerberos.keytab=
-ranger.authz.remote.authn.header.<trusted-header>=</pre>
- <p class=MsoNormal> </p>
- <h2>5.3 PDP Python APIs</h2>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Ranger PDP Python APIs are provided by RangerPdpClient class in <a href="https://pypi.org/project/apache-ranger/">apache-ranger</a> library.</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Here is an example of PDP Python APIs to authorize access to Hive table:</p>
- <p class=MsoNormal> </p>
- <pre class=CodeBlock>from apache_ranger.client.ranger_pdp_client import RangerPDPClient
-from apache_ranger.model.ranger_authz import (
-RangerAccessContext,
-RangerAccessInfo,
-RangerAuthzRequest,
-RangerResourceInfo,
-RangerUserInfo,
-)
-from requests_kerberos import HTTPKerberosAuth</pre>
- <p class=MsoNormal> </p>
- <pre class=CodeBlock>pdp = RangerPDPClient("https://ranger-pdp.example.com", auth=HTTPKerberosAuth())</pre>
- <p class=MsoNormal> </p>
- <pre class=CodeBlock>user = RangerUserInfo({"name": "alice"})
-resource = RangerResourceInfo({"name": "table:sales/customers/accounts"})
-access = RangerAccessInfo({"resource": resource,
- "action": "QUERY",
- "permissions": [ "select" ]})
-
-ctx = RangerAccessContext({"serviceType": "trino", "serviceName": "sales_trino"})</pre>
- <p class=MsoNormal> </p>
- <pre class=CodeBlock>req = RangerAuthzRequest({"user": user, "access": access, "context": ctx })
-res = pdp.authorize(req)</pre>
- <p class=MsoNormal> </p>
- <pre class=CodeBlock>print(res.decision)</pre>
- <p class=MsoNormal> </p>
- <h1 id="s6">6. Policy Administration</h1>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Before an application can use Ranger policies, the Ranger service corresponding to the application must be registered and configured. This involves three administrative steps.</p>
- <p class=MsoNormal> </p>
- <h2>6.1 Register service definition</h2>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>The application's service definition must first be registered with Ranger Admin. The service definition describes the application's authorization model, including:</p>
- <p class=MsoNormal> </p>
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>resources that can be protected</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>access types</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>data-masking capabilities</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>row-filtering capabilities</p>
- <p class=MsoListParagraphCxSpLast style='text-indent:-.25in'><span style='font-family:Symbol'>-<span style='font:7.0pt "Times New Roman"'> </span></span>configuration properties used by the service</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Registering, updating, or deleting a service definition requires Ranger administrator privileges. Typically, the application/integration developer provides the service definition, while a Ranger administrator registers it in the Ranger Admin service. Another option is to include the service definition in Apache Ranger git repository, which will be loaded by Ranger admin service during its initialization.</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Once registered, the service definition becomes the template from which Ranger service instances can be created.</p>
- <p class=MsoNormal> </p>
- <h2>6.2 Create a Ranger service</h2>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>A Ranger service represents a particular instance of an application or service for which policies are managed. For example, an application might have separate Ranger services for different environments:</p>
- <p class=MsoNormal> </p>
- <pre class=CodeBlock>Service definition: trino
-Services: dev_trino, prod_trino, sales_trino, mktg_trino</pre>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Creating a Ranger service requires Ranger administrator privileges. When creating a service, the administrator provides application specific configurations, including the details required by Ranger admin to connect to the application for resource lookup. Following configurations can be used to specify list of users and groups whose members can create, update, delete, and read policies for the service:</p>
- <p class=MsoNormal> </p>
- <pre class=CodeBlock>service.admin.users
-service.admin.groups</pre>
- <p class=MsoNormal> </p>
- <h2>6.3 Delegated policy administration</h2>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Ranger supports delegated administration, which allows policy management privileges to be restricted to a subset of resources and permissions within a service. For example, consider prod_hive service containing resources from several business domains:</p>
- <p class=MsoNormal> </p>
- <pre class=CodeBlock>prod_hive
- |
- |--- finance
- | +-- payroll
- | +-- expenses
- |
- |___ hr
- | +-- employees
- | +-- benefits</pre>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>A service administrator can create a policy with delegated-administration privileges for the contents of a database named finance, granting users in the finance-admin group permission to manage policies. Users in the finance-admin group can then create and modify policies for resources within their delegated resource and permissions scope only.</p>
- <p class=MsoNormal> </p>
- <h2>6.4 Roles</h2>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Ranger supports roles as a way to manage grants to a set of users and groups. A role can contain multiple users, groups or other roles. Roles are useful when the same set of permissions needs to be assigned to multiple users or groups without creating separate policies for each user.</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>For example, a Ranger administrator can create roles and assign users and groups to roles:</p>
- <p class=MsoNormal> </p>
- <pre class=CodeBlock>sales-data-reader
- |
- +-- add group analysts
- +-- add group reporting users
-
-sales-data-writer
- |
- +-- add group data-engineers</pre>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>A user with service policy administrator privileges can grant permissions a role:</p>
- <p class=MsoNormal> </p>
- <pre class=CodeBlock>sales-data
- |
- +-- grant read permission to sales-data-reader and sales-data-writer
- +-- grant write permission to sales-data-writer</pre>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>The application does not need to implement role evaluation itself. Ranger evaluates the roles associated with the requesting user when determining whether an access request is allowed.</p>
- <p class=MsoNormal> </p>
- <h2>6.5 Security Zones</h2>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>For larger deployments, Ranger can also organize services and resources into <a href="https://cwiki.apache.org/confluence/display/RANGER/Introduction+of+Security+Zones+in+Ranger">security zones</a>. A security zone can provide an additional administrative boundary spanning resources, potentially across multiple services.</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>Applications do not need to implement anything special for security-zone support; the important consideration is that the service definition and resource model expose the resources in a way that allows administrators to place them into the appropriate policy scope.</p>
- <p class=MsoNormal> </p>
- <h1 id="references">References</h1>
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'>-<span style='font:7.0pt "Times New Roman"'> </span><a href="https://cwiki.apache.org/confluence/display/RANGER/Ranger+Client+Libraries">Apache Ranger: Java client libraries</a></p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>-<span style='font:7.0pt "Times New Roman"'> </span><a href="https://pypi.org/project/apache-ranger/">Apache Ranger: Python client library</a></p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>-<span style='font:7.0pt "Times New Roman"'> </span><a href="https://ranger.apache.org/apidocs/index.html">Apache Ranger: REST API documentation</a></p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>-<span style='font:7.0pt "Times New Roman"'> </span><a href="https://cwiki.apache.org/confluence/display/RANGER/Introduction+of+Security+Zones+in+Ranger">Apache Ranger: security zones</a></p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>-<span style='font:7.0pt "Times New Roman"'> </span><a href="https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=65868896">Apache Ranger: row-filter and data-masking policies</a></p>
- <p class=MsoListParagraphCxSpLast style='text-indent:-.25in'>-<span style='font:7.0pt "Times New Roman"'> </span><a href="policy_model.html">Apache Ranger Policy Model</a></p>
- <p class=MsoNormal> </p>
- </div>
- </div>
- </body>
-
- <footer>
- <div align=center >
- <a href="/blogs.html">Apache Ranger™ blogs</a>
- </div>
- </footer>
-</html>
diff --git a/docs/src/site/resources/blogs/policy_model.html b/docs/src/site/resources/blogs/policy_model.html
deleted file mode 100644
index cfc5eaa82..000000000
--- a/docs/src/site/resources/blogs/policy_model.html
+++ /dev/null
@@ -1,634 +0,0 @@
-<!--
- Licensed to the Apache Software Foundation (ASF) under one or more
- contributor license agreements. See the NOTICE file distributed with
- this work for additional information regarding copyright ownership.
- The ASF licenses this file to You under the Apache License, Version 2.0
- (the "License"); you may not use this file except in compliance with
- the License. You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
--->
-<!DOCTYPE html>
-<html lang="en">
-
- <head>
- <meta http-equiv=Content-Type content="text/html; charset=utf-8">
- <title>Apache Ranger Policy Model</title>
- <style>
- <!--
- /* Font Definitions */
- @font-face {font-family:Wingdings; panose-1:5 0 0 0 0 0 0 0 0 0;}
- @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;}
- @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;}
- @font-face {font-family:"Calibri Light"; panose-1:2 15 3 2 2 2 4 3 2 4;}
-
- /* Style Definitions */
- p.MsoNormal, li.MsoNormal, div.MsoNormal
- {margin:0in; font-size:12.0pt; font-family:"Calibri",sans-serif;}
- h1
- {mso-style-link:"Heading 1 Char"; margin-top:12.0pt; margin-right:0in; margin-bottom:0in; margin-left:0in; page-break-after:avoid; font-size:16.0pt; font-family:"Calibri Light",sans-serif; color:#2F5496; font-weight:normal;}
- h2
- {mso-style-link:"Heading 1 Char"; margin-top:10.0pt; margin-right:0in; margin-bottom:0in; margin-left:0in; page-break-after:avoid; font-size:14.0pt; font-family:"Calibri Light",sans-serif; color:#2F5496; font-weight:normal;}
-
- p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
- {margin-top:0in; margin-right:0in; margin-bottom:0in; margin-left:.5in; font-size:12.0pt; font-family:"Calibri",sans-serif;}
- p.MsoListParagraphCxSpFirst, li.MsoListParagraphCxSpFirst, div.MsoListParagraphCxSpFirst
- {margin-top:0in; margin-right:0in; margin-bottom:0in; margin-left:.5in; font-size:12.0pt; font-family:"Calibri",sans-serif;}
- p.MsoListParagraphCxSpMiddle, li.MsoListParagraphCxSpMiddle, div.MsoListParagraphCxSpMiddle
- {margin-top:0in; margin-right:0in; margin-bottom:0in; margin-left:.5in; font-size:12.0pt; font-family:"Calibri",sans-serif;}
- p.MsoListParagraphCxSpLast, li.MsoListParagraphCxSpLast, div.MsoListParagraphCxSpLast
- {margin-top:0in; margin-right:0in; margin-bottom:0in; margin-left:.5in; font-size:12.0pt; font-family:"Calibri",sans-serif;}
- span.Heading1Char
- {mso-style-name:"Heading 1 Char"; mso-style-link:"Heading 1"; font-family:"Calibri Light",sans-serif; color:#2F5496;}
- span.FootnoteTextChar
- {mso-style-name:"Footnote Text Char"; mso-style-link:"Footnote Text";}
- .MsoChpDefault
- {font-family:"Calibri",sans-serif;}
-
- /* Page Definitions */
- @page WordSection1
- {size:8.5in 11.0in; margin:1.0in 1.0in 1.0in 1.0in;}
- div.WordSection1
- {page:WordSection1;}
-
-
- /* List Definitions */
- ol
- {margin-bottom:0in;}
- ul
- {margin-bottom:0in;}
- -->
- </style>
- </head>
-
- <body lang=EN-US style='width:800px;word-wrap:break-word;align:center;margin:auto;border:ridge' >
- <div style="margin-left:10pt;margin-right:10pt">
- <h1 style="text-align:center">Apache Ranger Policy Model</h1>
- <p class=MsoNormal style='font:5.0pt "Times New Roman"'> </p>
- <div style="text-align:center">
- <p class=MsoNormal>Madhan Neethiraj, Apache Ranger committer</p>
- <p class=MsoNormal>Mar 08, 2022</p>
- </div>
- <p class=MsoNormal> </p>
-
- <div class=WordSection>
- <h1>Introduction</h1>
-
- <p class=MsoNormal>
- Apache Ranger is an extensible framework that enables enterprises to adopt a consistent approach to authorize
- access to their resources across multiple services/applications/cloud. Apache Ranger framework also enables
- enterprises to collect audit logs of access to their resources, to help meet various compliance requirements.
- </p>
-
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal>
- Apache Ranger is a central part of security in many large deployments in enterprises across various domains
- like finance, retail, insurance, healthcare, services. Apache Ranger has out-of-the box support for a large
- number of popular services and many more services are supported by commercial vendors. Apache Ranger is highly
- optimized for performance, adds negligible overhead in authorizing access to resources. It has been very well
- proven in very high throughput services like Apache Kafka, Apache HBase which perform thousands of
- authorizations per second.
- </p>
-
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal>
- Apache Ranger provides an intuitive web user interface to manage authorization policies and audit logs for
- access to resources across a large number of services. Apache Ranger also provides REST, Python, Java APIs for
- programmatic integration with tools used by enterprises. Open framework provided by Apache Ranger enables
- enterprises to extend Apache Ranger authorization to their own applications and services as well.
- </p>
-
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal>
- Here are few key points that make Apache Ranger a compelling option for enterprises looking to standardize
- authorization of access to their resources:
- </p>
-
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'>1.<span style='font:7.0pt "Times New Roman"'> </span>out-of-the-box support for more than a dozen popular services like Apache Hive, Apache HBase, Apache Kafka, Apache Solr, Elasticsearch, Apache NiFi and Presto.</p>
-
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>2.<span style='font:7.0pt "Times New Roman"'> </span>support for services like Amazon EMR, AWS S3, ADLS-Gen2, GCS, Snowflake, Google BigQuery, Trino, Dremio, Starburst, Apache Impala, Postgres, MS-SQL and Amazon Redshift by commercial vendors.</p>
-
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>3.<span style='font:7.0pt "Times New Roman"'> </span>policies for access authorization, row-filters, data masking.</p>
-
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>4.<span style='font:7.0pt "Times New Roman"'> </span>resource-based, classification-based policies, role-based, attribute-based policies.</p>
-
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>5.<span style='font:7.0pt "Times New Roman"'> </span>delegated administration, deny and exceptions in policies, custom conditions.</p>
-
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>6.<span style='font:7.0pt "Times New Roman"'> </span>centralized audit logs of accesses to enterprise resources across multiple services, interactive user interface to view audit logs of accesses.</p>
-
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>7.<span style='font:7.0pt "Times New Roman"'> </span>intuitive policy management UI.</p>
-
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>8.<span style='font:7.0pt "Times New Roman"'> </span>Java, Python, REST APIs for programmatic integration for policy management.</p>
-
- <p class=MsoListParagraphCxSpLast style='text-indent:-.25in'>9.<span style='font:7.0pt "Times New Roman"'> </span>open framework which enables enterprises to extend Apache Ranger authorization to their own applications and services.</p>
-
- <h1>Policy Model</h1>
-
- <p class=MsoNormal>
- At the core of Apache Ranger authorization is its policy model. We will go through key aspects of the Apache
- Ranger policy model in this section.
- </p>
-
- <h2>Resources</h2>
- <p class=MsoNormal>
- A resource is a fundamental element in the Apache Ranger policy model. Apache Ranger enables policies to
- authorize access to resources. In this context, a resource is anything whose access needs to be authorized,
- like a file/path, database, table, column, topic; but can also be a service – like Apache Knox topology.
- Apache Ranger policy model captures details of resources of a service in a declarative way – details like
- hierarchy, case-sensitivity, supports row-filter/data-masking, etc.
- </p>
-
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal>
- Type of resources vary across services/applications, as seen in the table below:
- </p>
-
- <p class=MsoNormal> </p>
-
- <table class=MsoTableGrid border=1 cellspacing=0 cellpadding=0 style='margin-left:30.35pt;border-collapse:collapse;border:none'>
- <tr>
- <td valign=top style='width:100pt;border:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;text-align:center'><p class=MsoNormal><b>Service</b></p></td>
- <td valign=top style='width:325pt;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt;text-align:center'><p class=MsoNormal><b>Resources</b></p></td>
- </tr>
- <tr>
- <td valign=top style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Apache Hive</p></td>
- <td valign=top style='width:325pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>databases, tables, columns, udfs</p></td>
- </tr>
- <tr>
- <td valign=top style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Apache Kafka</p></td>
- <td valign=top style='width:325pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>topics</p></td>
- </tr>
- <tr>
- <td valign=top style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Apache Solr</p></td>
- <td valign=top style='width:325pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>collections</p></td>
- </tr>
- <tr>
- <td valign=top style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>AWS S3</p></td>
- <td valign=top style='width:325pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>buckets, objects</p></td>
- </tr>
- <tr>
- <td valign=top style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>ADLS-Gen2</p></td>
- <td valign=top style='width:325pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>storage-accounts, containers, objects</p></td>
- </tr>
- <tr>
- <td valign=top style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Azure PowerBI</p></td>
- <td valign=top style='width:325pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>workspaces</p></td>
- </tr>
- <tr>
- <td valign=top style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Google BigQuery</p></td>
- <td valign=top style='width:325pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>projects, datasets, tables, columns</p></td>
- </tr>
- <tr>
- <td valign=top style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Snowflake</p></td>
- <td valign=top style='width:325pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>databases, schemas, tables, columns, warehouses</p></td>
- </tr>
- <tr>
- <td valign=top style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Trino</p></td>
- <td valign=top style='width:325pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>catalogs, schemas, tables, columns, procedures</p></td>
- </tr>
- <tr>
- <td valign=top style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>...</p></td>
- <td valign=top style='width:325pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal></p></td>
- </tr>
- </table>
-
- <h2>Permissions</h2>
- <p class=MsoNormal>
- A permission is another fundamental element in the Apache Ranger policy model. A permission is an action
- performed on a resource, like reading a file, creating a directory, querying a table, or publishing a message
- to a topic. Apache Ranger policy model captures details of permissions of a service in a declarative way –
- details like which permissions are applicable to specific resource types, implied permissions, etc.
- </p>
-
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal>
- Like resources, list of permissions varies across services/applications, as seen in the table below:
- </p>
-
- <p class=MsoNormal> </p>
- <table class=MsoTableGrid border=1 cellspacing=0 cellpadding=0 style='margin-left:30.35pt;border-collapse:collapse;border:none'>
- <tr>
- <td valign=top style='width:100pt;border:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;text-align:center'><p class=MsoNormal><b>Service</b></p></td>
- <td valign=top style='width:325pt;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt;text-align:center'><p class=MsoNormal><b>Permissions</b></p></td>
- </tr>
- <tr>
- <td valign=top style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Apache Hive</p></td>
- <td valign=top style='width:325pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>create, alter, drop, select, insert, ..</p></td>
- </tr>
- <tr>
- <td valign=top style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Apache Kafka</p></td>
- <td valign=top style='width:325pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>publish, consume, create, delete, describe, configure, ..</p></td>
- </tr>
- <tr>
- <td valign=top style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Apache Solr</p></td>
- <td valign=top style='width:325pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>query, update, others, Solr admin</p></td>
- </tr>
- <tr>
- <td valign=top style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>AWS S3</p></td>
- <td valign=top style='width:325pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>read, write, delete, ..</p></td>
- </tr>
- <tr>
- <td valign=top style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>ADLS-Gen2</p></td>
- <td valign=top style='width:325pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>read, write, delete, ..</p></td>
- </tr>
- <tr>
- <td valign=top style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Azure PowerBI</p></td>
- <td valign=top style='width:325pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>contributor, member, admin, none</p></td>
- </tr>
- <tr>
- <td valign=top style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Google BigQuery</p></td>
- <td valign=top style='width:325pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>project-list, dataset-create, table-create, table-list, query, ..</p></td>
- </tr>
- <tr>
- <td valign=top style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Snowflake</p></td>
- <td valign=top style='width:325pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>CreateSchema, CreateTable, Select, Insert, Update, ..</p></td>
- </tr>
- <tr>
- <td valign=top style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Trino</p></td>
- <td valign=top style='width:325pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>create, alter, drop, select, insert, ..</p></td>
- </tr>
- <tr>
- <td valign=top style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>...</p></td>
- <td valign=top style='width:325pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal></p></td>
- </tr>
- </table>
-
- <h2>Users, Groups, Roles</h2>
- <p class=MsoNormal>
- Apache Ranger enables authorization policies to be set up to allow/deny permissions to users, groups, and
- roles. Users and groups are typically obtained from an enterprise directory like AD/LDAP. Apache Ranger
- user-sync module handles details of bringing users and groups from sources like LDAP/AD/OS, and keeping up
- with the changes in the sources - like addition of users and groups, addition/removal of a user from a group.
- </p>
-
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal>
- Apache Ranger user-sync supports retrieving attributes of users and groups as well. Such attributes, like
- dept/location/site-id, can be used in authorization policies to allow/deny access to resources, and set up
- row-filters that restrict users to access relevant subset of data. More on this later in this document.
- </p>
-
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal>
- In addition to users and groups, Apache Ranger supports roles to be used in authorization policies. A role in
- Apache Ranger is a grouping of users, groups, and other roles. Roles can be managed using Apache Ranger UI and
- REST APIs by authorized users. Role based authorization is widely used in enterprises and having support for
- roles in Apache Ranger makes it possible to use well established enterprise security practices in Apache Ranger
- authorization policies.
- </p>
-
- <h2>Delegated Admin</h2>
- <p class=MsoNormal>
- Apache Ranger enables decentralization of authorization policies management with support for delegated-admin
- feature. A set of users, groups and roles can be granted permission, via an Apache Ranger policy (what else!),
- to manage authorization policies for a subset of resources and permissions. For example, users in
- <samp>finance-admin</samp> group can be granted permissions to manage authorization policies for contents of
- Snowflake database named <samp>finance</samp>, and AWS S3 objects under <samp>s3://mybucket/dept/finance</samp>.
- This offers a scalable approach to manage authorization in large deployments.
- </p>
-
- <h2>Security Zone</h2>
- <p class=MsoNormal>
- Apache Ranger supports security zones to enable multi-tenancy within an organization where admins from
- different lines of businesses can manage security policies for their own resources. For example, data that
- belongs to the sales team can be managed by administrators of the sales team, similarly data of marketing,
- sales, operations teams can be managed by respective administrators.
- </p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>
- Also, security zones can be used to isolate resources based on purpose. For example, it is common for a data
- lake to have distinct areas and authorization policies for test data, unprocessed/raw data, semi-processed
- data, and production data. Apache Ranger makes it easier to manage security policies in such deployments with
- use of security zones like:
- </p>
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'>-<span style='font:7.0pt "Times New Roman"'> </span>Test zone</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>-<span style='font:7.0pt "Times New Roman"'> </span>Landing zone</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>-<span style='font:7.0pt "Times New Roman"'> </span>Staging zone</p>
- <p class=MsoListParagraphCxSpLast style='text-indent:-.25in'>-<span style='font:7.0pt "Times New Roman"'> </span>Production zone</p>
- <p class=MsoNormal>
- A security zone can contain resources from multiple services/applications, like AWS S3, ADLS-Gen2, GCS,
- Snowflake, Amazon Redshift, Postgres, Apache Hadoop, Apache Hive, Apache HBase, Apache Kafka. This makes it
- easier to set up consistent authorization policies across multiple services by a set of administrators
- designated for each security zone.
- </p>
-
- <h2>Allow, Deny, Exceptions</h2>
- <p class=MsoNormal>
- In addition to authorization policies that can grant access to resources, Apache Ranger also enables policies
- to be setup to:
- </p>
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'>-<span style='font:7.0pt "Times New Roman"'> </span>deny access to users/groups/roles on resources</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>-<span style='font:7.0pt "Times New Roman"'> </span>exclude a subset of users from accesses allowed/denied above</p>
- <p class=MsoListParagraphCxSpLast style='text-indent:-.25in'>-<span style='font:7.0pt "Times New Roman"'> </span>deny all access to specific resources other than the ones allowed in the policy</p>
- <p class=MsoNormal>
- This makes it easier to set up policies to protect sensitive resources.
- </p>
-
- <h2>Wildcards, macros, variables in resource names</h2>
- <p class=MsoNormal>
- Apache Ranger policies support use of wildcards, macros, and variables in resource names. This makes it
- possible to use small number of policies for a large number of resources, as shown below:
- </p>
-
- <p class=MsoNormal> </p>
- <table class=MsoTableGrid border=1 cellspacing=0 cellpadding=0 valign=center style='margin-left:30.35pt;border-collapse:collapse;border:none'>
- <tr>
- <td style='width:100pt;border:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;text-align:center'><p class=MsoNormal><b>Policy Resource</b></p></td>
- <td style='width:450pt;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt;text-align:center'><p class=MsoNormal><b>Description</b></p></td>
- </tr>
- <tr>
- <td style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><samp>test_<b>*</b></samp></p></td>
- <td style='width:450pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>matches all resources having name that start with test_</p></td>
- </tr>
- <tr>
- <td style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><samp>/home/<b>{USER}</b></samp></p></td>
- <td style='width:450pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>a path under /home having name of current user</p></td>
- </tr>
- <tr>
- <td style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><samp>/dept/<b>${{USER.dept}}</b></samp></p></td>
- <td style='width:450pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>a path under /dept having name of current user’s department</p></td>
- </tr>
- </table>
- <p class=MsoNormal></p>
-
- <h2>Policy validity schedule</h2>
- <p class=MsoNormal>
- Apache Ranger enables policies to be effective only for specific time schedules. This feature can be used to
- create policies that need to be effective at a future time, for example to allow access to revenue reports for
- a wider audience only after a specific time. This feature can also be used to allow temporary access to
- specific users/groups/roles, with a specific start and end times.
- </p>
- <p class=MsoNormal> </p>
-
- <h1>Attribute based access control</h1>
- <p class=MsoNormal>
- Apache Ranger enables use of user, group, resource, classification, and the environment attributes in
- authorization policies. ABAC makes it possible to express authorization policies without prior knowledge of
- specific resources, specific users – which helps avoid the need for new policies as new resources or users are
- introduced.
- </p>
- <br/>
- <p class=MsoNormal>
- For example:
- </p>
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'>-<span style='font:7.0pt "Times New Roman"'> </span>allow each user to access all tables owned by them, using <b><i>{OWNER}</i></b> macro:</p>
- <table class=MsoTableGrid border=1 cellspacing=0 cellpadding=0 valign=center style='margin-left:30pt;border-collapse:collapse;border:none'>
- <tr style='border:solid'>
- <td style='width:75pt;border-right:solid;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><samp>resource</samp></p></td>
- <td style='width:200pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>database=*, table=*</p></td>
- </tr>
- <tr style='border:solid;border-top:none'>
- <td style='width:75pt;border-right:solid;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>users</p></td>
- <td style='width:200pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><b>{OWNER}</b></p></td>
- </tr>
- <tr style='border:solid;border-top:none'>
- <td style='width:75pt;border-right:solid;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>permissions</p></td>
- <td style='width:200pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>all</p></td>
- </tr>
- </table>
- <p></p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>-<span style='font:7.0pt "Times New Roman"'> </span>allow users to access their department data in AWS S3, by using user attribute <b><i>${{USER.dept}}</i></b>:</p>
- <table class=MsoTableGrid border=1 cellspacing=0 cellpadding=0 valign=center style='margin-left:30pt;border-collapse:collapse;border:none'>
- <tr style='border:solid'>
- <td style='width:75pt;border-right:solid;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><samp>resource</samp></p></td>
- <td style='width:300pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>bucket=mycompany, object=/data/<b><i>${{USER.dept}}</i></b>/*</p></td>
- </tr>
- <tr style='border:solid;border-top:none'>
- <td style='width:75pt;border-right:solid;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>users</p></td>
- <td style='width:300pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><b>{USER}</b></p></td>
- </tr>
- <tr style='border:solid;border-top:none'>
- <td style='width:75pt;border-right:solid;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>permissions</p></td>
- <td style='width:300pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>read,write</p></td>
- </tr>
- </table>
- <p></p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>-<span style='font:7.0pt "Times New Roman"'> </span>allow users in mktg group to access <samp>PII</samp> data of email type, by using tag attribute <b><i>TAG.piiType</i></b>:</p>
- <table class=MsoTableGrid border=1 cellspacing=0 cellpadding=0 valign=center style='margin-left:30pt;border-collapse:collapse;border:none'>
- <tr style='border:solid'>
- <td style='width:75pt;border-right:solid;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><samp>resource</samp></p></td>
- <td style='width:200pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>tag=PII</p></td>
- </tr>
- <tr style='border:solid;border-top:none'>
- <td style='width:75pt;border-right:solid;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>groups</p></td>
- <td style='width:200pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>mktg</p></td>
- </tr>
- <tr style='border:solid;border-top:none'>
- <td style='width:75pt;border-right:solid;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>condition</p></td>
- <td style='width:200pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><b><i>TAG.piiType == 'email'</i></b></p></td>
- </tr>
- <tr style='border:solid;border-top:none'>
- <td style='width:75pt;border-right:solid;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>permissions</p></td>
- <td style='width:200pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>select</p></td>
- </tr>
- </table>
- <p></p>
- <p class=MsoListParagraphCxSpLast style='text-indent:-.25in'>-<span style='font:7.0pt "Times New Roman"'> </span>tables with <samp>SENSITIVE</samp> classification should be accessible only by users having privileges for that sensitive level</p>
- <table class=MsoTableGrid border=1 cellspacing=0 cellpadding=0 valign=center style='margin-left:30pt;border-collapse:collapse;border:none'>
- <tr style='border:solid'>
- <td style='width:75pt;border-right:solid;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><samp>resource</samp></p></td>
- <td style='width:300pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>tag=SENSITIVE</p></td>
- </tr>
- <tr style='border:solid;border-top:none'>
- <td style='width:75pt;border-right:solid;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>groups</p></td>
- <td style='width:300pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>public</p></td>
- </tr>
- <tr style='border:solid;border-top:none'>
- <td style='width:75pt;border-right:solid;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>condition</p></td>
- <td style='width:300pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><b><i>TAG.sensitiveLevel < USER.allowedSensitiveLevel</i></b></p></td>
- </tr>
- <tr style='border:solid;border-top:none'>
- <td style='width:75pt;border-right:solid;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>permissions</p></td>
- <td style='width:300pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>select</p></td>
- </tr>
- </table>
-
- <h1>Resource based access control</h1>
- <p class=MsoNormal>
- Apache Ranger enables setting up policies to grant or deny permissions to users/group/roles based on specific
- resource names, like:
- </p>
- <br/>
-
- <table class=MsoTableGrid border=1 cellspacing=0 cellpadding=0 valign=center style='margin-left:30.35pt;border-collapse:collapse;border:none'>
- <tr>
- <td style='width:100pt;border:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;text-align:center'><p class=MsoNormal><b>Service</b></p></td>
- <td style='width:200pt;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt;text-align:center'><p class=MsoNormal><b>Resource</b></p></td>
- <td style='width:120pt;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt;text-align:center'><p class=MsoNormal><b>Permission</b></p></td>
- </tr>
- <tr>
- <td style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Apache Hive</p></td>
- <td style='width:200pt;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt;text-align:left'>
- <table class=MsoTableGrid border=1 cellspacing=0 cellpadding=0 valign=center style='margin-left:3pt;margin-top:3pt;margin-bottom:3pt;border-collapse:collapse;border:none'>
- <tr>
- <td style='width:100pt;border:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'>database</td>
- <td style='width:100pt;border:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'>sales</td>
- </tr>
- <tr>
- <td style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'>table</td>
- <td style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'>order_data</td>
- </tr>
- <tr>
- <td style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'>column</td>
- <td style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'>order_amount</td>
- </tr>
- </table>
- </td>
- <td style='width:120pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>select</p></td>
- </tr>
- <tr>
- <td style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Apache Kafka</p></td>
- <td style='width:200pt;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt;text-align:left'>
- <table class=MsoTableGrid border=1 cellspacing=0 cellpadding=0 style='margin-left:3pt;margin-top:3pt;margin-bottom:3pt;border-collapse:collapse;border:none'>
- <tr>
- <td style='width:100pt;border:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'>topic</td>
- <td style='width:100pt;border:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'>finance</td>
- </tr>
- </table>
- </td>
- <td style='width:120pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>publish, consume</p></td>
- </tr>
- <tr>
- <td style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>AWS S3</p></td>
- <td style='width:200pt;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt;text-align:left'>
- <table class=MsoTableGrid border=1 cellspacing=0 cellpadding=0 style='margin-left:3pt;margin-top:3pt;margin-bottom:3pt;border-collapse:collapse;border:none'>
- <tr>
- <td style='width:100pt;border:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'>bucket</td>
- <td style='width:100pt;border:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'>mycompany</td>
- </tr>
- <tr>
- <td style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'>path</td>
- <td style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'>/home/{USER}</td>
- </tr>
- </table>
- </td>
- <td style='width:120pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>read, write, delete</p></td>
- </tr>
- <tr>
- <td style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>ADLS-Gen2</p></td>
- <td style='width:200pt;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt;text-align:left'>
- <table class=MsoTableGrid border=1 cellspacing=0 cellpadding=0 valign=center style='margin-left:3pt;margin-top:3pt;margin-bottom:3pt;border-collapse:collapse;border:none'>
- <tr>
- <td style='width:100pt;border:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'>storage-account</td>
- <td style='width:100pt;border:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'>mycompany</td>
- </tr>
- <tr>
- <td style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'>container</td>
- <td style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'>home</td>
- </tr>
- <tr>
- <td style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'>path</td>
- <td style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'>/{USER}</td>
- </tr>
- </table>
- </td>
- <td style='width:120pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>read, write, delete</p></td>
- </tr>
- <tr>
- <td style='width:100pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>...</p></td>
- <td style='width:200pt;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt;text-align:left'></td>
- <td style='width:120pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal></p></td>
- </tr>
- </table>
-
- <h1>Tag based access control</h1>
- <p class=MsoNormal>
- In addition to authorization policies on resources, Apache Ranger enables policies to be set up on
- classifications (tags) associated with resources. This feature enables enterprises to separate responsibility
- of classification of resources (PII, PCI, PHI, credit card number, etc.) from setting up access-control
- policies. Classifications created, by a team of data stewards and tools that scan data for sensitive
- information, can be leveraged to drive authorization to access the resources.
- </p>
-
- <p class=MsoNormal> </p>
-
- <p class=MsoNormal>
- Authorization policies on the classifications themselves, instead of directly on the resources, will ensure
- that appropriate policies will automatically be applied as classifications are added, removed, and updated on
- resources. Also, a single tag-based policy (for example on PII) can be used to authorize access to resources
- across multiple services like AWS S3, ADLS-Gen2, Snowflake, Databricks SQL, Apache Hive, Apache HBase, Apache
- Kafka. This can significantly reduce the complexity in managing authorization policies.
- </p>
-
- <h1>Data masking</h1>
- <p class=MsoNormal>
- Apache Ranger data-masking policies enable enterprises to allow access to sensitive data suitably masked
- depending on the context in which a user accesses the data. Some users will need the data without masking,
- while some other users can only be allowed to see partial or masked or transformed value. While authorization
- policies can be used to either allow or deny access to certain data, data-masking policies enable dynamically
- mask sensitive data as users access the data, for example to ensure that:
- </p>
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'>-<span style='font:7.0pt "Times New Roman"'> </span>analysts have access to only specific part of birthday (year or month or day)</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>-<span style='font:7.0pt "Times New Roman"'> </span>only last 4 digits of a national id are available to customer service representatives</p>
- <p class=MsoListParagraphCxSpLast style='text-indent:-.25in'>-<span style='font:7.0pt "Times New Roman"'> </span>only salary ranges of employees (i.e., not the salary) are available to analysts</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>
- In addition to supporting data-masking policies on resources, like columns in Apache Hive/Snowflake/Databricks
- SQL/Presto, Apache Ranger enables setting up data-masking policies based on classifications (tags) associated
- with resources. This can significantly reduce the complexity in managing masking policies. In addition,
- tag-based masking policies leverage classifications added to resources by data stewards and tools that scan
- data for sensitive information.
- </p>
-
- <h1>Row-filter</h1>
- <p class="MsoNormal">
- Apache Ranger row-filter policies enable enterprises to allow users to access only a subset of data depending
- upon the context in which a user accesses the data. When a table having a row-filter is accessed by the user,
- only a subset of rows will be visible to the user – depending upon the filter setup in row-filter policy.
- Row-filters can be used for example to ensure that:
- </p>
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'>-<span style='font:7.0pt "Times New Roman"'> </span>data of customers residing in a country is available only to analysts authorized to access the country’s data</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>-<span style='font:7.0pt "Times New Roman"'> </span>a store manager has access to only data relevant to the store she/he works in</p>
- <p class=MsoListParagraphCxSpLast style='text-indent:-.25in'>-<span style='font:7.0pt "Times New Roman"'> </span>analysts don’t have access to sensitive records</p>
-
- <h1>Access audit logs</h1>
- <p class=MsoNormal>
- Apache Ranger generates audit logs of accesses to resources protected by Apache Ranger authorization. Apache
- Ranger can be configured to store audit logs in multiple destinations, including Solr, HDFS, AWS S3, AWS
- CloudWatch, ADLS-Gen2, Elasticsearch. Audit logs generated by Apache Ranger include following details, which
- can help enterprises to satisfy various compliance requirements:
- </p>
- <p class=MsoNormal></p>
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'>-<span style='font:7.0pt "Times New Roman"'> </span>resource accessed; action performed; was access allowed</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>-<span style='font:7.0pt "Times New Roman"'> </span>time of access, tags associated with the resource (PII, PCI, PHI, ..)</p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>-<span style='font:7.0pt "Times New Roman"'> </span>who performed the access, IP address from which the access was performed</p>
- <p class=MsoListParagraphCxSpLast style='text-indent:-.25in'>-<span style='font:7.0pt "Times New Roman"'> </span>ID of Apache Ranger policy that allowed or denied the access</p>
- <p class=MsoNormal> </p>
- <p class=MsoNormal>
- Apache Ranger provides an interactive user interface to view audit logs stored in Solr, Elasticsearch or AWS
- CloudWatch, with search capabilities to look for access audits for specific resources, specific users, client
- IP addresses, within a given time frame, specific classifications. Apache Ranger audit logs can be stored in
- ORC or JSON formats, which can then be loaded into various tools for analysis.
- </p>
- <p class=MsoNormal> </p>
-
- <h1>References</h1>
- <p class=MsoListParagraphCxSpFirst style='text-indent:-.25in'>-<span style='font:7.0pt "Times New Roman"'> </span><a href="https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=61322361">Apache Ranger: tag-based policies</a></p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>-<span style='font:7.0pt "Times New Roman"'> </span><a href="https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=65868896">Apache Ranger: row-filter and data-masking policies</a></p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>-<span style='font:7.0pt "Times New Roman"'> </span><a href="https://cwiki.apache.org/confluence/display/RANGER/Introduction+of+Security+Zones+in+Ranger">Apache Ranger: security zones</a></p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>-<span style='font:7.0pt "Times New Roman"'> </span><a href="https://pypi.org/project/apache-ranger/">Apache Ranger: Python</a></p>
- <p class=MsoListParagraphCxSpMiddle style='text-indent:-.25in'>-<span style='font:7.0pt "Times New Roman"'> </span><a href="https://cwiki.apache.org/confluence/display/RANGER/Ranger+Client+Libraries">Apache Ranger: Java</a></p>
- <p class=MsoListParagraphCxSpLast style='text-indent:-.25in'>-<span style='font:7.0pt "Times New Roman"'> </span><a href="https://ranger.apache.org/apidocs/index.html">Apache Ranger: REST</a></p>
- </div>
- </div>
- </body>
-
- <footer>
- <div align=center >
- <a href="/blogs.html">Apache Ranger™ blogs</a>
- </div>
- </footer>
-</html>
diff --git a/docs/src/site/resources/css/custom.css b/docs/src/site/resources/css/custom.css
index e41df59dd..4be44c1b4 100644
--- a/docs/src/site/resources/css/custom.css
+++ b/docs/src/site/resources/css/custom.css
@@ -1,5 +1,6 @@
/* You can override this file with your own styles */
@import url('https://fonts.googleapis.com/css2?family=Raleway:wght@300;400;600&family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;1,300;1,400&display=swap');
+@import url('../blogs/blog.css');
.project-ranger{
overflow-x: hidden;
diff --git a/docs/src/site/xdoc/blogs.xml b/docs/src/site/xdoc/blogs.xml
index 7bcbb0802..4bbcb5f27 100644
--- a/docs/src/site/xdoc/blogs.xml
+++ b/docs/src/site/xdoc/blogs.xml
@@ -17,58 +17,49 @@
-->
<document>
<body>
-<section name="Apache Ranger™ blogs">
-<ul>
- <li>
- <p>
- <a href="blogs/policy_model.html" target="_blank">Apache Ranger Policy Model</a>
- </p>
- Apache Ranger provides a rich and extensible policy model to support access control, data masking, row-filters, RBAC, ABAC and TBAC. This blog highlights key features of the policy model along with few examples.<br/>
- <div style="font-size: 90%;color: #999;">
- Posted on Mar 08, 2022 by Madhan Neethiraj, Apache Ranger committer
- </div>
+<section name="Apache Ranger blogs">
+<div class="ranger-blog-index">
+ <p class="ranger-blog-index__intro">
+ Technical articles from the Apache Ranger community on policy models, access control patterns, and integration guides.
+ </p>
+ <ul class="ranger-blog-index__list">
+ <li class="ranger-blog-index__card">
+ <a href="blogs/integrating_applications.html">Integrating applications with Apache Ranger</a>
+ <p class="ranger-blog-index__summary">
+ How applications integrate with Apache Ranger through service definitions, embedded plugins, and the PDP server.
+ </p>
+ <p class="ranger-blog-index__meta">Madhan Neethiraj · Aug 24, 2026</p>
</li>
- <p/>
- <li>
- <p>
- <a href="blogs/adventures_in_abac_1.html" target="_blank">Adventures in attribute-based access control (ABAC) - part 1</a>
- </p>
- Explores choices for setting up access control based on sensitivity level and content of the data, and attributes of the user.<br/>
- <div style="font-size: 90%;color: #999;">
- Posted on Apr 29, 2023 by Barbara Eckman, Comcast
- </div>
+ <li class="ranger-blog-index__card">
+ <a href="blogs/dynamic_expressions.html">Dynamic expressions</a>
+ <p class="ranger-blog-index__summary">
+ Using dynamic expressions and context attributes in Apache Ranger policies.
+ </p>
+ <p class="ranger-blog-index__meta">Madhan Neethiraj · Dec 10, 2023</p>
</li>
- <p/>
- <li>
- <p>
- <a href="blogs/adventures_in_abac_2.html" target="_blank">Adventures in attribute-based access control (ABAC) - part 2</a>
- </p>
- Explores use of attribute based access control to address more advanced use cases.<br/>
- <div style="font-size: 90%;color: #999;">
- Posted on Oct 15, 2023 by Barbara Eckman, Comcast
- </div>
+ <li class="ranger-blog-index__card">
+ <a href="blogs/adventures_in_abac_2.html">Adventures in attribute-based access control (ABAC) - part 2</a>
+ <p class="ranger-blog-index__summary">
+ Advanced ABAC use cases for complex access control constraints.
+ </p>
+ <p class="ranger-blog-index__meta">Barbara Eckman · Oct 15, 2023</p>
</li>
- <p/>
- <li>
- <p>
- <a href="blogs/dynamic_expressions.html" target="_blank">Dynamic expressions</a>
- </p>
- Explores use of dynamic expressions using context attributes in Apache Ranger policies.<br/>
- <div style="font-size: 90%;color: #999;">
- Posted on Dec 10, 2023 by Madhan Neethiraj, Apache Ranger committer
- </div>
+ <li class="ranger-blog-index__card">
+ <a href="blogs/adventures_in_abac_1.html">Adventures in attribute-based access control (ABAC) - part 1</a>
+ <p class="ranger-blog-index__summary">
+ Access control approaches based on data sensitivity and user attributes.
+ </p>
+ <p class="ranger-blog-index__meta">Barbara Eckman · Apr 29, 2023</p>
</li>
- <p/>
- <li>
- <p>
- <a href="blogs/integrating_applications.html" target="_blank">Integrating applications with Apache Ranger</a>
- </p>
- Describes how applications can integrate with Apache Ranger through service definitions, embedded plugins, and the PDP server.<br/>
- <div style="font-size: 90%;color: #999;">
- Posted on Aug 24, 2026 by Madhan Neethiraj, Apache Ranger committer
- </div>
+ <li class="ranger-blog-index__card">
+ <a href="blogs/policy_model.html">Apache Ranger policy model</a>
+ <p class="ranger-blog-index__summary">
+ Key features of the Ranger policy model for access control, masking, row-filters, RBAC, ABAC, and TBAC.
+ </p>
+ <p class="ranger-blog-index__meta">Madhan Neethiraj · Mar 08, 2022</p>
</li>
-</ul>
+ </ul>
+</div>
</section>
</body>
</document>
diff --git a/docs/src/site/xdoc/blogs/adventures_in_abac_1.xml b/docs/src/site/xdoc/blogs/adventures_in_abac_1.xml
new file mode 100644
index 000000000..a163744fb
--- /dev/null
+++ b/docs/src/site/xdoc/blogs/adventures_in_abac_1.xml
@@ -0,0 +1,208 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<document>
+ <head>
+ <link href="../css/custom.css" rel="stylesheet"/>
+ </head>
+ <body>
+ <section name="Adventures in attribute-based access control (ABAC) - Part 1">
+<div class="ranger-blog-post">
+<div class="ranger-blog__header">
+ <p class="ranger-blog__back"><a href="../blogs.html">← All blogs</a></p>
+<p class="ranger-blog__meta">Barbara Eckman, Ph.D., Distinguished Architect, Comcast · Apr 29, 2023</p>
+ </div>
+<div class="ranger-blog__body">
+ <h1>Introduction</h1>
+
+ <p>
+ Simply put, data access control enforces constraints on who is permitted to access the data. An access control policy
+ specifies 1) which data may be accessed by 2) which users and optionally 3) for how long
+ <a href="#_ftn1" name="_ftnref1" title="">[1]</a>.
+ </p><p>Data can be specified in access control policies in multiple ways:</p>
+
+ <p class="ranger-blog__list-item">1. Resource-based access control: data is specified by its logical identifier e.g., table name, column name, Kafka topic name, AWS S3 bucket name.</p>
+
+ <p class="ranger-blog__list-item">2. Tag-based access control (TBAC): data is specified by one or more of its properties, represented by a tag on its metadata, e.g., a Sales Region or Sensitivity Level.</p>
+
+ <p class="ranger-blog__list-item">3. Row access control: specifies rows/records that are visible to the user at run time by setting up filters based on the value of an attribute, e.g., Sales Region is "US”.</p>
+
+ <p class="ranger-blog__list-item">4. Masking access control: specifies if the data should be masked before making it available the user.
+ <a href="#_ftn2" name="_ftnref2" title="">[2]</a>
+ </p><p>Users can be specified in access control policies in multiple ways:</p>
+
+ <p class="ranger-blog__list-item">1. by their individual IDs, or by their group IDs.</p>
+
+ <p class="ranger-blog__list-item">2. by the roles the users belong to e.g., "USSalesPerson”. This approach is generally called Role-Based Access Control (RBAC).</p><p>It’s generally acknowledged that RBAC and TBAC are more maintainable, easier to understand, and therefore less error-prone than resource-based access control and identifying users by their IDs or group IDs. However, these are not sufficient for even moderately complex access control constraints, as we will see.</p>< [...]
+ <tr>
+ <td><p><b>User</b></p></td>
+ <td><p><b>Region</b></p></td>
+ <td><p><b>Access Level</b></p></td>
+ </tr>
+ <tr>
+ <td><p>Bob</p></td>
+ <td><p>US</p></td>
+ <td><p>Highly Sensitive</p></td>
+ </tr>
+ <tr>
+ <td><p>Celestine</p></td>
+ <td><p>EMEA</p></td>
+ <td><p>Sensitive</p></td>
+ </tr>
+ </table>
+
+ <h2>Contents</h2>
+ <p><a href="#s1">1. Resource and Identity-based Access Control: USSales</a></p>
+ <p><a href="#s2">2. Resource and Identity-based Access Control: GlobalSales</a></p>
+ <p><a href="#s3">3. Tag-based and Role-based Access Control: USSales</a></p>
+ <p><a href="#s4">4. Tag-based and Role-based Access Control: GlobalSales</a></p>
+ <p><a href="#s5">5. Beyond Tag-based and Role-based Access Control: GlobalSalesPartners</a></p>
+
+ <h1 id="s1">Resource and Identity-based Access Control: USSales</h1>
+ <p>Consider the following table containing data from the US sales region.</p>
+ <p class="ranger-blog-caption">
+ <img width="700" height="140" id="Picture 6" src="adventures_in_abac_1.files/table_ussales.jpg" alt="Table USSales" />
+ </p><p>Resource and identity-based access-control policies might include:</p>
+ <p class="ranger-blog__list-item">- Allow Bob to access all columns because he’s from the US and has access to Highly Sensitive data.</p>
+ <p class="ranger-blog__list-item">- Deny access to Celestine on the table because she’s from EMEA, i.e., not from US.</p><p class="ranger-blog-caption">
+ <img width="700" height="800" border="1" id="policy_table_ussales_rib" src="adventures_in_abac_1.files/fig01-policy_ussales_rib.jpg" alt="Fig 1. Apache Ranger™ resource and identity-based access policy for table USSales" />
+ </p><p class="ranger-blog-caption">Fig 1. Apache Ranger™ resource and identity-based access policy for table USSales</p><p>This isn’t too onerous with two users, one table, and two Sales Regions.</p>
+
+ <h1 id="s2">Resource and Identity-based Access Control: GlobalSales</h1>
+ <p>Let’s add a bit of complexity. Consider the following table containing data from several sales regions, including US and EMEA.</p>
+ <p class="ranger-blog-caption">
+ <img width="780" height="180" id="Picture 7" src="adventures_in_abac_1.files/table_globalsales.jpg" alt="Table: GlobalSales" />
+ </p><p>Resource-based and identity-based access-control policy might include:</p>
+ <p class="ranger-blog__list-item">- Allow Bob to access all columns in rows having salesRegion=US because he’s from the US and has access to Highly Sensitive data.</p>
+ <p class="ranger-blog__list-item">- Allow Celestine to access columns c1-c10 in rows having salesRegion=EMEA because she’s from EMEA and has access to Sensitive data.</p>
+ <p class="ranger-blog__list-item">- Deny users from non-matching regions any access to the table.</p><p class="ranger-blog-caption">
+ <img width="700" height="800" border="1" id="Picture 9" src="adventures_in_abac_1.files/fig02-policy_globalsales_highly_sensitive.jpg" alt="Fig 2. Apache Ranger™ access policy for highly sensitive data in table GlobalSales" />
+ </p><p class="ranger-blog-caption">Fig 2. Apache Ranger™ access policy for highly sensitive data in table GlobalSales</p><p class="ranger-blog-caption">
+ <img width="700" height="800" border="1" id="Picture 14" src="adventures_in_abac_1.files/fig03-policy_globalsales_sensitive.jpg" alt="Fig 3. Apache Ranger™ access policy for sensitive data in table GlobalSales" />
+ </p><p class="ranger-blog-caption">Fig 3. Apache Ranger™ access policy for sensitive data in table GlobalSales</p><p class="ranger-blog-caption">
+ <img width="700" height="800" border="1" id="Picture 22" src="adventures_in_abac_1.files/fig04-policy_globalsales_non_sensitive.jpg" alt="Fig 4. Apache Ranger™ access policy for non-sensitive data in table GlobalSales" />
+ </p><p class="ranger-blog-caption">Fig 4. Apache Ranger™ access policy for non-sensitive data in table GlobalSales</p><p class="ranger-blog-caption">
+ <img width="700" height="800" border="1" id="Picture 16" src="adventures_in_abac_1.files/fig05-policy_globalsales_row_filter_sales_region.jpg" alt="Fig 5. Apache Ranger™ row-filter policy to restrict access to data in table GlobalSales based on sales region" />
+ </p><p class="ranger-blog-caption">Fig 5. Apache Ranger™ row-filter policy to restrict access to data in table GlobalSales based on sales region</p><p>Note that the fact that Bob is from the US with access to highly sensitive data is not explicitly captured in the above policies. Nor are the sensitivity levels of the two sets of columns. This knowledge is implicit only, making the policies difficult to maintain over time as business rules change.</p><h1 id="s3">Tag-based an [...]
+ <p>In this section we will explore using tags and roles (TBAC and RBAC) to set up access control on the USSales table.</p><p>Let’s use tags to capture metadata relevant to access control, and assign them to tables and columns as shown below:</p><table>
+ <tr>
+ <td><p><b>Table/Columns</b></p></td>
+ <td><p><b>Tag</b></p></td>
+ <td><p><b>Tag Attribute</b></p></td>
+ </tr>
+ <tr>
+ <td><p>USSales</p></td>
+ <td><p>salesRegion</p></td>
+ <td><p>value="US"</p></td>
+ </tr>
+ <tr>
+ <td><p>c1, c2, c3, c4, c5</p></td>
+ <td><p>sensitivityLevel</p></td>
+ <td><p>value="sensitive"</p></td>
+ </tr>
+ <tr>
+ <td><p>c6, c7, c8</p></td>
+ <td><p>sensitivityLevel</p></td>
+ <td><p>value="highlySensitive"</p></td>
+ </tr>
+ </table><p>Let’s use the following roles to capture users’ access scope by sensitivity level and region, and assign users as members of the appropriate roles:</p><p class="ranger-blog-caption">
+ <img width="700" height="380" border="1" id="Picture 23" src="adventures_in_abac_1.files/fig06-roles_capturing_sl_sr.jpg" alt="Fig 6. Apache Ranger™ roles to capture sensitivity level and sales region for users" />
+ </p><p class="ranger-blog-caption">Fig 6. Apache Ranger™ roles to capture sensitivity level and sales region for users</p><p>Tag-based and role-based access-control policies might include:</p>
+
+ <p class="ranger-blog__list-item">1. Tag: salesRegion</p>
+ <p class="ranger-blog__list-item ranger-blog__list-item--nested">a.Allow users in role salesRegion.US to access resources tagged with salesRegion.value = "US"</p>
+ <p class="ranger-blog__list-item ranger-blog__list-item--nested">b.Allow users in role salesRegion.EMEA to access resources tagged with salesRegion.value = "EMEA"</p><p class="ranger-blog-caption">
+ <img width="700" height="800" border="1" id="Picture 24" src="adventures_in_abac_1.files/fig07-policy_ussales_tag_attribute_based.jpg" alt="Fig 7. Apache Ranger™ tag attribute-based access policy for sales region" />
+ </p><p class="ranger-blog-caption">Fig 7. Apache Ranger™ tag attribute-based access policy for sales region</p><p class="ranger-blog__list-item">2. Tag: sensitivityLevel</p>
+ <p class="ranger-blog__list-item ranger-blog__list-item--nested">a.Allow users in role sensitivityLevel.sensitive to access resources tagged with sensitivityLevel.value = "sensitive", OR empty.</p>
+ <p class="ranger-blog__list-item ranger-blog__list-item--nested">b.Allow users in role sensitivityLevel.highlySensitive to access resources tagged with sensitivityLevel.value = "sensitive" OR "highlySensitive", OR empty.</p><p class="ranger-blog-caption">
+ <img width="700" height="800" border="1" id="Picture 25" src="adventures_in_abac_1.files/fig08-policy_tag_based_sl.jpg" alt="Fig 8. Apache Ranger™ tag attribute-based access policy for sensitivity level" />
+ </p><p class="ranger-blog-caption">Fig 8. Apache Ranger™ tag attribute-based access policy for sensitivity level</p><p>Note that the knowledge needed for access control is now explicit: the columns’ metadata is tagged with an explicit sensitivity level, and the users are explicitly members of the appropriate salesRegion role. </p><p>Note that these tag policies can be used to handle an EMEASales table as well as the USSales table, depending on whether the value of the tag i [...]
+
+ <p>In this section we return to the GlobalSales table. In this case we can’t use a simple salesRegion tag on the table, since the table contains data from multiple regions including US and EMEA. A row-filter is needed, as in the resource-based policy above. </p><p>As before, let’s use the following tags to capture metadata relevant to sensitivity access control, and have them assigned to columns as shown below:</p><table>
+ <tr>
+ <td><p><b>Columns</b></p></td>
+ <td><p><b>Tag</b></p></td>
+ <td><p><b>Tag Attribute</b></p></td>
+ </tr>
+ <tr>
+ <td><p>c2, c3</p></td>
+ <td><p>sensitivityLevel</p></td>
+ <td><p>value="sensitive"</p></td>
+ </tr>
+ <tr>
+ <td><p>c11, c12, c13, c14</p></td>
+ <td><p>sensitivityLevel</p></td>
+ <td><p>value="highlySensitive"</p></td>
+ </tr>
+ </table><p>Also, let’s use the same roles listed in the previous use case, Fig. 6</p><p>Tag-based and role-based access-control policies might include:</p>
+
+ <p class="ranger-blog__list-item">1. Tag: sensitivityLevel: same policy as the previous use case, Fig. 8</p>
+ <p class="ranger-blog__list-item">2. Row filter Policy:</p>
+ <p class="ranger-blog__list-item ranger-blog__list-item--nested">a.Users in the salesRegion.US role have access to rows where salesRegion = "US"</p>
+ <p class="ranger-blog__list-item ranger-blog__list-item--nested">b.Users in the salesRegion.EMEA role have access to rows where salesRegion = "EMEA"</p><p class="ranger-blog-caption">
+ <img width="700" height="800" border="1" id="Picture 28" src="adventures_in_abac_1.files/fig09-policy_globalsales_row_filter_sr_roles.jpg" alt="Fig 9. Apache Ranger™ row-filter policy to restrict access to data in table GlobalSales based on sales region and user roles" />
+ </p><p class="ranger-blog-caption">Fig 9. Apache Ranger™ row-filter policy to restrict access to data in table GlobalSales based on sales region and user roles</p><p>This policy controls access by any user who has been assigned to a salesRegion role, not simply bob or celestine. </p><h1 id="s5">Beyond Tag-based and Role-based Access Control: GlobalSalesPartners</h1>
+ <p>As our final level of complexity, in this section we will extend access control to a GlobalSalesPartners table that includes info on which business partner ("ABC" or "XYZ") produced the data.</p><p>
+ <img width="780" height="180" id="Picture 8" src="adventures_in_abac_1.files/table_globalsalespartners.jpg" alt="Table GlobalSalesPartners" />
+ </p><p>The following additional conditions must be enforced for accessing data in this table:</p>
+ <p class="ranger-blog__list-item">1. Bob can see only data from partner "ABC"</p>
+ <p class="ranger-blog__list-item">2. Celestine can see data from both partners.</p><p>As before, let’s use the following tags to capture metadata relevant to sensitivity level, and have them assigned to columns as shown below:</p><table>
+ <tr>
+ <td><p><b>Columns</b></p></td>
+ <td><p><b>Tag</b></p></td>
+ <td><p><b>Tag Attribute</b></p></td>
+ </tr>
+ <tr>
+ <td><p>c2, c3</p></td>
+ <td><p>sensitivityLevel</p></td>
+ <td><p>value="sensitive"</p></td>
+ </tr>
+ <tr>
+ <td><p>c11, c12, c13, c14</p></td>
+ <td><p>sensitivityLevel</p></td>
+ <td><p>value="highlySensitive"</p></td>
+ </tr>
+ </table><p>Let’s use the following roles to capture the users’ access scope by sensitivity level, region, and sales partner, and assign our users as members of the appropriate roles:</p><p class="ranger-blog-caption">
+ <img width="700" height="380" border="1" id="Picture 29" src="adventures_in_abac_1.files/fig10-roles_capturing_sl_sr_sp.jpg" alt="Fig 10. Apache Ranger™ roles to capture sensitivity level, sales region and sales partners for users" />
+ </p><p class="ranger-blog-caption">Fig 10. Apache Ranger™ roles to capture sensitivity level, sales region and sales partners for users</p><p>Tag-based and role-based access-control policies might include:</p>
+ <p class="ranger-blog__list-item">1. Tag: sensitivityLevel: same policy as earlier use case, Fig. 8</p>
+ <p class="ranger-blog__list-item">2. Row filter Policy:</p>
+ <p class="ranger-blog__list-item ranger-blog__list-item--nested">a.Users in salesRegion.US role have access to rows where salesRegion = "US"</p>
+ <p class="ranger-blog__list-item ranger-blog__list-item--nested">b.Users in salesRegion.EMEA role have access to rows where salesRegion = "EMEA"</p>
+ <p class="ranger-blog__list-item ranger-blog__list-item--nested">c.Users in salesPartner.ABC role have access to rows where salesPartner = "ABC"</p>
+ <p class="ranger-blog__list-item ranger-blog__list-item--nested">d.Users in salesPartner.XYZ role has access to rows where salesPartner = "XYZ"</p><p class="ranger-blog-caption">
+ <img width="700" height="800" border="1" id="Picture 36" src="adventures_in_abac_1.files/fig11-policy_globalsalespartners_row_filter_sr_sp.jpg" alt="Fig 11. Apache Ranger™ row-filter policy to restrict access to data in table GlobalSalesPartners based on sales region and sales partner" />
+ </p><p class="ranger-blog-caption">Fig 11. Apache Ranger™ row-filter policy to restrict access to data in table GlobalSalesPartners based on sales region and sales partner</p><p>It is easy to see that as the numbers of salesRegions and salesPartners rise, the number of roles and row filter conditions increases combinatorially, and rapidly becomes difficult to manage. </p><p>As I said before, built-in Apache Ranger™ TBAC, RBAC, and row-filter based access policies are [...]
+
+ <div>
+ <br clear="all" />
+ <hr align="left" size="1" width="33%" />
+ <div id="ftn1">
+ <p><a href="#_ftnref1" name="_ftn1" title="">[1]</a>Specifying expiration dates for access control policies where relevant. This is not specific to ABAC and so we won’t discuss it further in this blog series.</p>
+ <p> </p>
+ </div>
+
+ <div id="ftn2">
+ <p><a href="#_ftnref2" name="_ftn2" title="">[2]</a>We will cover details of masking policies in a subsequent blog.</p>
+ <p> </p>
+ </div>
+ </div>
+</div>
+ </section>
+ </body>
+</document>
diff --git a/docs/src/site/xdoc/blogs/adventures_in_abac_2.xml b/docs/src/site/xdoc/blogs/adventures_in_abac_2.xml
new file mode 100644
index 000000000..d5ed0a30f
--- /dev/null
+++ b/docs/src/site/xdoc/blogs/adventures_in_abac_2.xml
@@ -0,0 +1,183 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<document>
+ <head>
+ <link href="../css/custom.css" rel="stylesheet"/>
+ </head>
+ <body>
+ <section name="Adventures in attribute-based access control (ABAC) - Part 2">
+<div class="ranger-blog-post">
+<div class="ranger-blog__header">
+ <p class="ranger-blog__back"><a href="../blogs.html">← All blogs</a></p>
+<p class="ranger-blog__meta">Barbara Eckman, Ph.D., Distinguished Architect, Comcast · Oct 15, 2023</p>
+ </div>
+<div class="ranger-blog__body">
+ <h1>Introduction</h1>
+
+ <p>
+ Previously in <a href="./adventures_in_abac_1.html">Part 1</a> of this series we examined an increasingly
+ complex series of use cases involving role membership and row filtering. While built-in Apache Ranger™
+ TBAC, RBAC, and row-filter based access policies are powerful, they may not be sufficient for complex access
+ control constraints. As the numbers of row filters that must be simultaneously enforced rises, the number of
+ roles and row filter conditions increases combinatorially and rapidly becomes difficult to manage.
+ </p><p>
+ This post introduces the principles of Attribute-based Access Control (ABAC) and shows how they enable us to
+ avoid this potentially mushrooming complexity. Let’s recall the final use case from part 1.
+ </p>
+
+ <h2>Contents</h2>
+ <p><a href="#s1">1. Recap: GlobalSalesPartners table row filters</a></p>
+ <p><a href="#s2">2. ABAC Principles</a></p>
+ <p><a href="#s3">3. Welcome to Attribute Based Access Control (ABAC)!</a></p>
+ <p><a href="#s4">4. GlobalSalesPartners Row-Filters Using ABAC</a></p>
+ <p><a href="#s5">5. ABAC in Tag-Based Policies</a></p>
+
+ <h1 id="s1">Recap: GlobalSalesPartners table row filters</h1>
+ <p>
+ The GlobalSalesPartners table includes info on which business partner (“ABC” or “XYZ”) produced the data, as
+ well as the salesRegion where the sale occurred.
+ </p>
+ <p class="ranger-blog-caption">
+ <img width="780" height="180" id="Picture 6" src="adventures_in_abac_2.files/table_globalsalespartners.jpg" alt="Table USSales" />
+ </p><p>Recall our favorite users:</p>
+
+ <table>
+ <tr>
+ <td><p><b>User</b></p></td>
+ <td><p><b>Region</b></p></td>
+ <td><p><b>Partner</b></p></td>
+ </tr>
+ <tr>
+ <td><p>Bob</p></td>
+ <td><p>US</p></td>
+ <td><p>ABC</p></td>
+ </tr>
+ <tr>
+ <td><p>Celestine</p></td>
+ <td><p>EMEA</p></td>
+ <td><p>ABC, XYZ</p></td>
+ </tr>
+ </table><p>Row-filter policies from part 1:</p>
+
+ <p class="ranger-blog__list-item ranger-blog__list-item--nowrap">1.Users in salesRegion.US role have access to rows where salesRegion = “US”</p>
+ <p class="ranger-blog__list-item ranger-blog__list-item--nowrap">2.Users in salesRegion.EMEA role have access to rows where salesRegion = “EMEA”</p>
+ <p class="ranger-blog__list-item ranger-blog__list-item--nowrap">3.Users in salesPartner.ABC role have access to rows where salesPartner = “ABC”</p>
+ <p class="ranger-blog__list-item ranger-blog__list-item--nowrap">4.Users in salesPartner.XYZ role has access to rows where salesPartner = “XYZ”</p><p class="ranger-blog-caption">
+ <img width="700" height="800" border="1" id="policy_table_ussales_rib" src="adventures_in_abac_2.files/fig1-policy_globalsalespartners_row_filter_sr_sp.jpg" alt="Fig 1. Apache Ranger™ Table GlobalSalesPartners: row-filter policy to restrict access based on sales region and sales partner" />
+ </p><p class="ranger-blog-caption">Fig 1. Apache Ranger™ Table GlobalSalesPartners: row-filter policy to restrict access based on sales region and sales partner</p><p>
+ We noted previously that as the numbers of salesRegions and salesPartners rise, the number of
+ roles and row filter conditions increases combinatorially, and rapidly becomes difficult to manage.
+ </p>
+
+ <h1 id="s2">ABAC Principles</h1>
+ <p>
+ But what if Ranger policy engine had direct access to Bob‘s sales partners, and Bob‘s sales region, without
+ reference to any roles he might be a member of? Then a row filter could be expressed this way, assuming Bob
+ has access to data from only one sales region and sales partner
+ </p>
+
+ <p class="ranger-blog-code-line"><partner attribute value in row> == <Bob’s partner> AND<br /><sales region value in row> == <Bob’s region></p>
+
+ <p>Now assume this can be generalized to work for all users:</p>
+
+ <p class="ranger-blog-code-line"><partner attribute value in row> == $USER.partner AND<br /><sales region value in row> == $USER.region</p>
+
+ <h1 id="s3">Welcome to Attribute Based Access Control (ABAC)!</h1>
+ <p>
+ In RBAC, the role to which a user is assigned membership is the central method of expressing what the user
+ should be allowed access to. Bob is in the role partner.ABC, along with, say, Sarah and Thomas and Srikanth
+ and Joon. Thus, all these users have access to partner ABC’s data.
+ </p><p>
+ In ABAC, the central method of expressing what the user should be allowed to have access to is the value of
+ the user’s attributes. Bob’s partner attribute value equals “ABC”, along with the partner attribute of Sarah
+ and Thomas and Srikanth and Joon. Just as in the RBAC case, all these users have access to partner ABC’s data.
+ </p><p>
+ But how do we program this in Apache Ranger? Apache Ranger uses a user-store, populated with users and their
+ attributes typically loaded from LDAP, SCIM, Azure Active Directory (AAD), Okta, etc., by Apache Ranger
+ usersync. If an attribute named partner is added to a user’s record on the identity provider, then that
+ information will be gathered as part of the usersync and can be referenced within a Ranger policy condition
+ as $USER.partner.
+ </p><h1 id="s4">GlobalSalesPartners Row-Filters Using ABAC</h1>
+ <p>
+ Assume that the UserStore has been populated with salesRegion and salesPartner attributes for Bob and
+ Celestine as follows:
+ </p><table>
+ <tr>
+ <td><p><b>User</b></p></td>
+ <td><p><b>salesRegion</b></p></td>
+ <td><p><b>salesPartner</b></p></td>
+ </tr>
+ <tr>
+ <td><p>Bob</p></td>
+ <td><p>US</p></td>
+ <td><p>ABC</p></td>
+ </tr>
+ <tr>
+ <td><p>Celestine</p></td>
+ <td><p>EMEA</p></td>
+ <td><p>XYZ</p></td>
+ </tr>
+ </table><p>
+ With ABAC, the 8 row filter conditions from the previous blog post become a single condition, matching the
+ users’ partners and regions with the value in the salesPartner and salesRegion columns:
+ </p><p class="ranger-blog-caption">
+ <img width="700" height="380" border="1" id="Picture 23" src="adventures_in_abac_2.files/fig2-policy_globalsalespartners_row_filter_abac.jpg" alt="Fig 2. Apache Ranger™ Table GlobalSalesPartners: ABAC-based row-filter policy to restrict access based on sales region and sales partner" />
+ </p><p class="ranger-blog-caption">Fig 2. Apache Ranger™ Table GlobalSalesPartners: ABAC-based row-filter policy to restrict access based on sales region and sales partner</p><p>
+ This policy works for all users, not just those with salesRegion or salesPartner access like Bob’s or Celestine’s.
+ </p>
+
+ <h1 id="s5">ABAC in Tag-Based Policies</h1>
+ <p>
+ Next, consider tables representing a single sales region, like USSales from blog post Part 1.
+ </p><table>
+ <tr>
+ <td><p><b>Resource</b></p></td>
+ <td><p><b>Tag</b></p></td>
+ <td><p><b>Tag Attribute</b></p></td>
+ </tr>
+ <tr>
+ <td><p>Table: USSales</p></td>
+ <td><p>salesRegion</p></td>
+ <td><p>value=”US”</p></td>
+ </tr>
+ </table><p>
+ Allow only users in the salesRegion.US role to access resources tagged with salesRegion.value = ”US”. Create
+ a role-based (RBAC) tag policy that allows access to tagged tables based on the role membership of the user:
+ </p><p class="ranger-blog-caption">
+ <img width="700" height="380" border="1" id="Picture 23" src="adventures_in_abac_2.files/fig3-policy_tag_based_on_user_role.jpg" alt="Fig 3. Apache Ranger™ Tag-based policy allowing access to tagged tables based on the user’s role membership" />
+ </p><p class="ranger-blog-caption">Fig 3. Apache Ranger™ Tag-based policy allowing access to tagged tables based on the user’s role membership</p><p>
+ Using the RBAC method, we need to create a policy condition for each of the salesRegion.* roles. Depending on
+ how many salesRegions a company defines, this could get large. And if they are continually being added or
+ subtracted, the policy has to be commensurately updated.
+ </p><p>
+ Let’s use ABAC to greatly simplify this process, by creating a tag policy that allows table access to any user
+ whose salesRegion attribute matches the attribute of the salesRegion tag:
+ </p>
+
+ <p class="ranger-blog-caption">
+ <img width="700" height="380" border="1" id="Picture 23" src="adventures_in_abac_2.files/fig4-policy_tag_policy_abac.jpg" alt="Fig 3. Apache Ranger™ ABAC-based tag policy to allow access to tables based on the value of the user’s attribute." />
+ </p><p class="ranger-blog-caption">Fig 4. Apache Ranger™ ABAC-based tag policy to allow access to tables based on the value of the user’s attribute.</p><p>
+ As we have seen, ABAC makes policy creation and maintenance much easier! But what if the custodians of your
+ Identity Provider are too busy to keep up with managing the additional attributes you need for ABAC? Is there
+ another way to populate the UserStore? Yes! Check out Part 3 of this blog series to find out how you can
+ retrieve UserStore entries from a variety of alternative sources!
+ </p></div>
+</div>
+ </section>
+ </body>
+</document>
diff --git a/docs/src/site/xdoc/blogs/dynamic_expressions.xml b/docs/src/site/xdoc/blogs/dynamic_expressions.xml
new file mode 100644
index 000000000..900a4c0ad
--- /dev/null
+++ b/docs/src/site/xdoc/blogs/dynamic_expressions.xml
@@ -0,0 +1,569 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<document>
+ <head>
+ <link href="../css/custom.css" rel="stylesheet"/>
+ </head>
+ <body>
+ <section name="Apache Ranger - Dynamic Expressions">
+<div class="ranger-blog-post">
+<div class="ranger-blog__header">
+ <p class="ranger-blog__back"><a href="../blogs.html">← All blogs</a></p>
+<p class="ranger-blog__meta">Madhan Neethiraj, Apache Ranger committer · Dec 12, 2023</p>
+ </div>
+<div class="ranger-blog__body">
+ <h1>Introduction</h1>
+
+ <p>
+ Apache Ranger policy model offers a rich set of features that help security administrators handle various
+ access
+ and governance requirements with ease. These features include:
+ </p>
+
+
+
+ <div class="ranger-blog__list-group">
+
+ <p class="ranger-blog__list-item">1. Consistent model to authorize access data in large number of services</p>
+
+ <p class="ranger-blog__list-item">2. Ability to dynamically apply data masking and row-filtering</p>
+
+ <p class="ranger-blog__list-item">3. Delegated access control administration</p>
+
+ <p class="ranger-blog__list-item">4. Ability to explicitly deny access</p>
+
+ <p class="ranger-blog__list-item">5. Use of wildcards in resource names in access policies</p>
+
+ <p class="ranger-blog__list-item">6. Role-based access control (RBAC)</p>
+
+ <p class="ranger-blog__list-item">7. Tag-based access control (TBAC), based on tags associated with resources</p>
+
+ <p class="ranger-blog__list-item">8. Attribute-based access control (ABAC), based on attributes of users, groups and tags</p>
+ </div>
+ <p>
+ In addition to above, Apache Ranger policies can use various attributes available in the access context to
+ authorize the access - attributes including resource owner, time of access, tags associated with the
+ accessed
+ resource, attributes of user/groups/tags, groups/roles the user belongs to. This document explores use cases
+ that can leverage such attributes in policies using dynamic expressions.
+ </p>
+
+ <h2>Contents</h2>
+ <p><a href="#s1">1. Dynamic expressions</a></p>
+ <p><a href="#s2">2. Supported expressions</a></p>
+
+ <h1 id="s1">Dynamic expressions</h1>
+
+ <p>
+ Apache Ranger policy engine evaluates dynamic expressions specified in policies using the script engine
+ included in the JVM, in a sandboxed environment. Dynamic expressions can be used in Apache Ranger policies
+ in
+ following contexts:
+ </p>
+
+ <h2>Policy conditions</h2>
+ <p>
+ Expressions can used in policy conditions to decide whether to evaluate the policy or a policy-item. These
+ expressions should evaluate to a boolean value i.e., <code>true</code>
+ or <code>false</code>. Examples:
+ </p>
+
+
+ <p>Condition for highly sensitive data (level >= 10)</p>
+
+ <p class="ranger-blog-code-line">TAG.sensitiveLevel >= 10</p>
+
+
+ <p>Condition to check if the user has appropriate level of clearance to access sensitive data</p>
+
+ <p class="ranger-blog-code-line">USER.allowedSensitiveLevel >= TAG.sensitiveLevel</p>
+
+
+ <p>Condition to check if the user belongs to group <code>finance</code> and is in role <code>analyst</code></p>
+
+ <p class="ranger-blog-code-line">IS_IN_GROUP('finance') AND IS_IN_ROLE('analyst')</p>
+
+
+ <h2>Row filters</h2>
+ <p>
+ Expressions can be used to set up row-filters with dynamic values. To distinguish expressions from the rest
+ of the row-filter text, they should be enclosed within delimiters <code>${{</code>
+ and <code>}}</code>. Examples:
+ </p>
+
+
+ <p>Row-filter expression to restrict users to access only rows belonging to their department:</p>
+
+ <p class="ranger-blog-code-line">dept_code == ${{USER.department}}</p>
+
+
+ <p>Row-filter expression to restrict users to access only rows from data sources specified in user attribute named <code>allowedSources</code>:</p>
+
+ <p class="ranger-blog-code-line">data_source in (${{USER.allowedSources}})</p>
+
+
+ <h2>Resource names</h2>
+ <p>
+ Use of expressions in resource names can help reduce the number of policies, which in
+ turn makes it easier to manage policies. Examples:
+ </p>
+
+
+ <p>Policy resource for home directory of the user:</p>
+
+ <p class="ranger-blog-code-line">/home/${{REQ.user}}</p>
+
+
+ <p>Policy resource for directory of user's department:</p>
+
+ <p class="ranger-blog-code-line">/data/dept/${{USER.dept}}</p>
+
+
+ <p>Policy resource for database of user's department:</p>
+
+ <p class="ranger-blog-code-line">db_${{USER.dept}}</p>
+
+
+ <h1 id="s2">Supported expressions</h1>
+ <table class="ranger-blog-table--expressions">
+ <tr>
+ <td>
+ <p><b>Variable/Function name</b></p>
+ </td>
+ <td>
+ <p><b>Description</b></p>
+ </td>
+ <td>
+ <p><b>Example values</b></p>
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <p>GET_TAG_NAMES()</p>
+ </td>
+ <td>
+ <p>Names of tags associated with the resource, as a CSV (comma separated values) string</p>
+ </td>
+ <td>
+ <p class="ranger-blog-code-line"><code>PII,FINANCE</code></p>
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <p>GET_TAG_ATTR_NAMES()</p>
+ </td>
+ <td>
+ <p>Names of attributes in all tags associated with the resource, as a CSV string</p>
+ </td>
+ <td>
+ <p class="ranger-blog-code-line"><code>piiType,sensitiveLevel</code></p>
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <p>GET_TAG_ATTR(attrName)</p>
+ </td>
+ <td>
+ <p>Value of the given attribute in tags associated with the resource, as a CSV string</p>
+ </td>
+ <td>
+ <p class="ranger-blog-code-line"><code>email</code></p>
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <p>GET_UG_NAMES()</p>
+ </td>
+ <td>
+ <p>Names of groups the user belongs to, as a CSV string</p>
+ </td>
+ <td>
+ <p class="ranger-blog-code-line"><code>managers,finance-admins</code></p>
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <p>GET_UG_ATTR_NAMES()</p>
+ </td>
+ <td>
+ <p>Names of all attributes in groups the user belongs to, as a CSV string</p>
+ </td>
+ <td>
+ <p class="ranger-blog-code-line"><code>attr1,attr2</code></p>
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <p>GET_UG_ATTR(attrName)</p>
+ </td>
+ <td>
+ <p>Value of the given attribute in groups the user belongs to, as a CSV string</p>
+ </td>
+ <td>
+ <p class="ranger-blog-code-line"><code>val1</code></p>
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <p>GET_UR_NAMES()</p>
+ </td>
+ <td>
+ <p>Names of roles assigned to the user, as a CSV string</p>
+ </td>
+ <td>
+ <p class="ranger-blog-code-line"><code>analyst,dba</code></p>
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <p>GET_USER_ATTR_NAMES()</p>
+ </td>
+ <td>
+ <p>Names of all attributes of the user, as a CSV string</p>
+ </td>
+ <td>
+ <p class="ranger-blog-code-line"><code>allowedSensitiveLevel, allowedSources</code></p>
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <p>GET_USER_ATTR(attrName)</p>
+ </td>
+ <td>
+ <p>Value of the given attribute associated with the user</p>
+ </td>
+ <td>
+ <p class="ranger-blog-code-line"><code>10</code></p>
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <p>HAS_TAG(tagName)</p>
+ </td>
+ <td>
+ <p>Is the given tag associated with the resource?</p>
+ </td>
+ <td>
+ <p class="ranger-blog-code-line"><code>true</code></p>
+ <p class="ranger-blog-code-line"><code>false</code></p>
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <p>HAS_ANY_TAG</p>
+ </td>
+ <td>
+ <p>Is any tag associated with the resource?</p>
+ </td>
+ <td>
+ <p class="ranger-blog-code-line"><code>true</code></p>
+ <p class="ranger-blog-code-line"><code>false</code></p>
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <p>HAS_NO_TAG</p>
+ </td>
+ <td>
+ <p>Are not tags associated with the resource?</p>
+ </td>
+ <td>
+ <p class="ranger-blog-code-line"><code>true</code></p>
+ <p class="ranger-blog-code-line"><code>false</code></p>
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <p>HAS_USER_ATTR(attrName)</p>
+ </td>
+ <td>
+ <p>Does the user have the given attribute?</p>
+ </td>
+ <td>
+ <p class="ranger-blog-code-line"><code>true</code></p>
+ <p class="ranger-blog-code-line"><code>false</code></p>
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <p>HAS_UG_ATTR(attrName)</p>
+ </td>
+ <td>
+ <p>Does any group associated with the user have the specified attribute?</p>
+ </td>
+ <td>
+ <p class="ranger-blog-code-line"><code>true</code></p>
+ <p class="ranger-blog-code-line"><code>false</code></p>
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <p>HAS_TAG_ATTR(attrName)</p>
+ </td>
+ <td>
+ <p>Does any tag associated with the resource have the specified attribute?</p>
+ </td>
+ <td>
+ <p class="ranger-blog-code-line"><code>true</code></p>
+ <p class="ranger-blog-code-line"><code>false</code></p>
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <p>IS_IN_GROUP(groupName)</p>
+ </td>
+ <td>
+ <p>Does the user belong to the specified group?</p>
+ </td>
+ <td>
+ <p class="ranger-blog-code-line"><code>true</code></p>
+ <p class="ranger-blog-code-line"><code>false</code></p>
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <p>IS_IN_ROLE(roleName)</p>
+ </td>
+ <td>
+ <p>Is the user assigned to the specified role?</p>
+ </td>
+ <td>
+ <p class="ranger-blog-code-line"><code>true</code></p>
+ <p class="ranger-blog-code-line"><code>false</code></p>
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <p>IS_IN_ANY_GROUP</p>
+ </td>
+ <td>
+ <p>Does the user belong to any group?</p>
+ </td>
+ <td>
+ <p class="ranger-blog-code-line"><code>true</code></p>
+ <p class="ranger-blog-code-line"><code>false</code></p>
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <p>IS_IN_ANY_ROLE</p>
+ </td>
+ <td>
+ <p>Is any role assigned to the user?</p>
+ </td>
+ <td>
+ <p class="ranger-blog-code-line"><code>true</code></p>
+ <p class="ranger-blog-code-line"><code>false</code></p>
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <p>IS_NOT_IN_ANY_GROUP</p>
+ </td>
+ <td>
+ <p>Does the user belong to no group?</p>
+ </td>
+ <td>
+ <p class="ranger-blog-code-line"><code>true</code></p>
+ <p class="ranger-blog-code-line"><code>false</code></p>
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <p>IS_NOT_IN_ANY_ROLE</p>
+ </td>
+ <td>
+ <p>Is the user associated with no roles?</p>
+ </td>
+ <td>
+ <p class="ranger-blog-code-line"><code>true</code></p>
+ <p class="ranger-blog-code-line"><code>false</code></p>
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <p>REQ</p>
+ </td>
+ <td>
+ <p>Request details, as a map</p>
+ </td>
+ <td>
+ <p class="ranger-blog-code-line"><code>{</code></p>
+ <p class="ranger-blog-code-line"><code> "accessType": "select",</code></p>
+ <p class="ranger-blog-code-line"><code> "clientIPAddress": "10.120.27.49",</code></p>
+ <p class="ranger-blog-code-line"><code> "clusterType": "etl",</code></p>
+ <p class="ranger-blog-code-line"><code> "clusterName": "etl-e1",</code></p>
+ <p class="ranger-blog-code-line"><code> "accessType": "select",</code></p>
+ <p class="ranger-blog-code-line"><code> "user": "scott",</code></p>
+ <p class="ranger-blog-code-line"><code> "userGroups": [ "g1" ],</code></p>
+ <p class="ranger-blog-code-line"><code> "userRoles": [ "r1" ],</code></p>
+ <p class="ranger-blog-code-line"><code>}</code></p>
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <p>RES</p>
+ </td>
+ <td>
+ <p>Resource details, as a map</p>
+ </td>
+ <td>
+ <p class="ranger-blog-code-line"><code>{</code></p>
+ <p class="ranger-blog-code-line"><code> "database": "db1",</code></p>
+ <p class="ranger-blog-code-line"><code> "table": "tbl1",</code></p>
+ <p class="ranger-blog-code-line"><code> "Column": "col1",</code></p>
+ <p class="ranger-blog-code-line"><code> "_ownerUser": "jane"</code></p>
+ <p class="ranger-blog-code-line"><code>}</code></p>
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <p>TAG</p>
+ </td>
+ <td>
+ <p>Current tag, as a map.</p>
+ <p>This is available only in tag-based policies.</p>
+ </td>
+ <td>
+ <p class="ranger-blog-code-line"><code>{</code></p>
+ <p class="ranger-blog-code-line"><code> "_type": "SENSITIVE",</code></p>
+ <p class="ranger-blog-code-line"><code> "sensitiveLevel": 10</code></p>
+ <p class="ranger-blog-code-line"><code>}</code></p>
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <p>TAGNAMES</p>
+ </td>
+ <td>
+ <p>Names of tags associated with the resource, as a list </p>
+ </td>
+ <td>
+ <p class="ranger-blog-code-line"><code>[ "PII", "SENSITIVE" ]</code></p>
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <p>TAGS</p>
+ </td>
+ <td>
+ <p>All tags associated with the resource, as a map</p>
+ </td>
+ <td>
+ <p class="ranger-blog-code-line"><code>{</code></p>
+ <p class="ranger-blog-code-line"><code> "SENSITIVE": {</code></p>
+ <p class="ranger-blog-code-line"><code> "_type", "SENSITIVE",</code></p>
+ <p class="ranger-blog-code-line"><code> "level": 10</code></p>
+ <p class="ranger-blog-code-line"><code> },</code></p>
+ <p class="ranger-blog-code-line"><code> "PII": {</code></p>
+ <p class="ranger-blog-code-line"><code> "_type", "PII",</code></p>
+ <p class="ranger-blog-code-line"><code> "piiType": "email"</code></p>
+ <p class="ranger-blog-code-line"><code> }</code></p>
+ <p class="ranger-blog-code-line"><code>}</code></p>
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <p>UGNAMES</p>
+ </td>
+ <td>
+ <p>Names of groups the user belongs to, as a list</p>
+ </td>
+ <td>
+ <p class="ranger-blog-code-line"><code>[ "g1" ]</code></p>
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <p>URNAMES</p>
+ </td>
+ <td>
+ <p>Names of roles the user is assigned to, as a list</p>
+ </td>
+ <td>
+ <p class="ranger-blog-code-line"><code>[ "r1" ]</code></p>
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <p>USER</p>
+ </td>
+ <td>
+ <p>Current user</p>
+ </td>
+ <td>
+ <p class="ranger-blog-code-line"><code>{</code></p>
+ <p class="ranger-blog-code-line"><code> "_name": "scott",</code></p>
+ <p class="ranger-blog-code-line"><code> "allowedSensitiveLevel": 10</code></p>
+ <p class="ranger-blog-code-line"><code>}</code></p>
+ </td>
+ </tr>
+ </table><p>
+ Most functions listed in the table above take optional parameters, to make it easier to handle use cases that require special handling.
+ </p>
+
+
+
+ <h2>Default value</h2>
+ <p>
+ A function call can include a default value as an optional parameter, which will be returned when there is no
+ value available. For example, consider the following expression:
+ </p><p class="ranger-blog-code-line">USER.allowedSensitiveLevel >= TAG.sensitiveLevel</p>
+
+ <p>
+ When the user doesn’t have an attribute named <code>allowedSensitiveLevel</code>, the expression will always evaluate to
+ false since <code>USER.allowedSensitiveLevel</code> would evaluate to <code>null</code>. To handle such cases, consider the following
+ alternate expression which would use <code>0</code> as the value instead of <code>null</code>:
+ </p><p class="ranger-blog-code-line">GET_USER_ATTR('allowedSensitiveLevel', 0) >= TAG.sensitiveLevel</p>
+
+ <p>
+ Here is another example of using default value in function calls:
+ </p><p class="ranger-blog-code-line">dept_code in (${{GET_UG_ATTR('deptCode', -1)}})</p>
+
+
+
+ <h2>Separator</h2>
+ <p>
+ Functions that return a CSV string, like GET_TAG_NAMES(), can include following optional parameters:
+ </p>
+
+ <p class="ranger-blog__list-item">optional #1. default value: value to return when no value is available</p>
+
+ <p class="ranger-blog__list-item">optional #2. separator: string to use as the separator between values</p><p>
+ Here is an example of using optional parameters:
+ </p>
+
+ <p class="ranger-blog-code-line">GET_TAG_NAMES('', '|') == 'tag1|tag2|tag3'</p>
+
+ <h2>Quotes</h2>
+ <p>
+ Each function that returns a CSV string has another version with _Q appended to the function name; this version
+ surrounds each value within quotes. For example, consider the following row-filter expression:
+ </p>
+
+ <p class="ranger-blog-code-line">location_state IN (${{GET_UG_ATTR_Q('state')}})</p><p>
+ The expression can evaluate to the following, if the user belongs to groups having an attribute named state:
+ </p>
+
+ <p class="ranger-blog-code-line">location_state IN ('CA','OR','WA')</p>
+
+</div>
+</div>
+ </section>
+ </body>
+</document>
diff --git a/docs/src/site/xdoc/blogs/integrating_applications.xml b/docs/src/site/xdoc/blogs/integrating_applications.xml
new file mode 100644
index 000000000..d87baf7d4
--- /dev/null
+++ b/docs/src/site/xdoc/blogs/integrating_applications.xml
@@ -0,0 +1,443 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<document>
+ <head>
+ <link href="../css/custom.css" rel="stylesheet"/>
+ </head>
+ <body>
+ <section name="Integrating Applications with Apache Ranger">
+<div class="ranger-blog-post">
+<div class="ranger-blog__header">
+ <p class="ranger-blog__back"><a href="../blogs.html">← All blogs</a></p>
+<p class="ranger-blog__meta">Madhan Neethiraj, Apache Ranger committer · Aug 24, 2026</p>
+ </div>
+<div class="ranger-blog__body">
+ <h1>Introduction</h1><p>
+ Apache Ranger provides a centralized framework for managing authorization policies and controlling access to resources in services such as HDFS, Ozone, HMS, Hive, Impala, Kafka, Solr, KMS, Atlas, Trino and Polaris. Enterprises use Ranger to address their data access governance needs, access auditing, delegated policy management by business users through an intuitive UI. This guide describes how an application can integrate with Apache Ranger to authorize access to its resources.
+ </p><h2>Contents</h2><p><a href="#s1">1. Apache Ranger</a></p>
+ <p><a href="#s2">2. Integration: Overview</a></p>
+ <p><a href="#s3">3. Integration: Service Definition</a></p>
+ <p><a href="#s4">4. Integration: Plugin</a></p>
+ <p><a href="#s5">5. Integration: PDP Server</a></p>
+ <p><a href="#s6">6. Policy Administration</a></p>
+ <p><a href="#references">References</a></p><h1 id="s1">1. Apache Ranger</h1><p>
+ Apache Ranger provides policy-based authorization for resources managed by applications. An application submits an authorization request identifying the user, resource, and requested access. Ranger evaluates the request against the applicable policies and returns an authorization decision.
+ </p><p>
+ Apache Ranger provides centralized policy administration through APIs and UI. Policies can be managed by Ranger administrators, designated administrators for each application and users delegated to manage policies for a limited resource scope.
+ </p><p>
+ Apache Ranger can audit access requests and authorization decisions. Audit records can include information such as the user, resource, requested access, authorization result, and request context.
+ </p><p>
+ Apache Ranger policies can control access based on:
+ </p><p class="ranger-blog__list-item">1. resource names and resource hierarchies.</p>
+ <p class="ranger-blog__list-item">2. tags associated with resources.</p>
+ <p class="ranger-blog__list-item">3. attributes and groups associated with users.</p>
+ <p class="ranger-blog__list-item">4. attributes associated with resources.</p>
+ <p class="ranger-blog__list-item">5. request context and policy conditions.</p><p>
+ Apache Ranger supports several types of data-access policies:
+ </p><p class="ranger-blog__list-item">1. Access policies determine whether a user is allowed or denied access to a resource.</p>
+ <p class="ranger-blog__list-item">2. Data masking policies determine how data should be masked when returned to an authorized user.</p>
+ <p class="ranger-blog__list-item">3. Row-filtering policies determine which rows of a dataset are visible to a user.</p><p>
+ The application is responsible for enforcing the authorization, masking, and filtering decisions returned by Ranger. For more on Ranger policy concepts, see the <a href="policy_model.html">Apache Ranger Policy Model</a> blog.
+ </p><h1 id="s2">2. Integration: Overview</h1><p>
+ An application integrates with Ranger in three basic steps:
+ </p><p class="ranger-blog__list-item">1. Register the application’s authorization model with Ranger.</p>
+ <p class="ranger-blog__list-item">2. Request authorization decisions from Ranger.</p>
+ <p class="ranger-blog__list-item">3. Enforce the decisions returned by Ranger.</p><p>
+ The application’s authorization model is represented by a Ranger service definition. A service definition describes the resources protected by the application, the access types that can be authorized, and optional data-masking and row-filtering capabilities. Ranger’s service-definition model includes resources, access types, service configurations, context enrichers, custom conditions, data-mask definitions, and row-filter definitions.
+ </p>
+ <h2>2.1 Register Application’s Service Definition</h2><p>The application defines its authorization model using a Ranger service definition.</p><p>The service definition describes:</p><p class="ranger-blog__list-item">- resources</p>
+ <p class="ranger-blog__list-item">- access types</p>
+ <p class="ranger-blog__list-item">- data-masking capabilities</p>
+ <p class="ranger-blog__list-item">- row-filtering capabilities</p>
+ <p class="ranger-blog__list-item">- service configuration properties</p><p>A service definition can be registered and managed through Apache Ranger’s service-definition APIs. Apache Ranger exposes APIs for creating, retrieving, updating, and deleting service definitions.</p><p>For example, an application managing datasets might define:</p><pre class="ranger-blog-pre">Resources:
+ catalog
+ database
+ table
+ column
+
+Access types:
+ create
+ alter
+ drop
+ select
+ update
+ </pre><p>Once the service definition is registered, administrators can create policies using these resources and access types.</p><h2>2.2 Request Authorization Decisions</h2><p>An application can obtain authorization decisions using either a Ranger plugin or the Ranger PDP APIs.</p><h3>Ranger Plugin</h3><p>Ranger plugin integration approach is typically used by Java applications. The plugin is embedded in the application and evaluates authorization requests locally using policies [...]
+ <img width="780" height="259" src="integrating_applications.files/image1.png" alt="Fig 1. Apache Ranger embedded plugin authorization flow" />
+ </p>
+ <p class="ranger-blog-caption">Fig 1. Apache Ranger embedded plugin authorization flow</p><h3>Ranger PDP</h3><p>Apache Ranger PDP server provides authorization service that applications can invoke through REST APIs. This integration approach is suitable for:</p><p class="ranger-blog__list-item">- non-Java applications</p>
+ <p class="ranger-blog__list-item">- applications that do not want to embed Ranger libraries</p>
+ <p class="ranger-blog__list-item">- applications requiring a smaller client-side footprint</p><p class="ranger-blog-caption">
+ <img width="780" height="231" src="integrating_applications.files/image2.png" alt="Fig 2. Apache Ranger PDP server authorization flow" />
+ </p>
+ <p class="ranger-blog-caption">Fig 2. Apache Ranger PDP server authorization flow</p><h2>2.3 Enforce the Authorization Decision</h2><p>Ranger returns an authorization decision; it does not enforce the decision on behalf of the application. The application must ensure that a denied request does not proceed.</p><h1 id="s3">3. Integration: Service Definition</h1><p>A Ranger service definition describes the authorization model exposed by an application or service. It tells Ranger wha [...]
+ <p class="ranger-blog__list-item">- <a href="https://github.com/apache/ranger/blob/master/agents-common/src/main/resources/service-defs/ranger-servicedef-ozone.json">Ozone</a></p>
+ <p class="ranger-blog__list-item">- <a href="https://github.com/apache/ranger/blob/master/agents-common/src/main/resources/service-defs/ranger-servicedef-hive.json">Hive</a></p>
+ <p class="ranger-blog__list-item">- <a href="https://github.com/apache/ranger/blob/master/agents-common/src/main/resources/service-defs/ranger-servicedef-trino.json">Trino</a></p>
+ <p class="ranger-blog__list-item">- <a href="https://github.com/apache/ranger/blob/master/agents-common/src/main/resources/service-defs/ranger-servicedef-polaris.json">Polaris</a></p><h2>3.1 Resources</h2><p>A resource definition identifies a resource that can appear in a Ranger policy. For example, here are few resources in Apache Hive service definition:</p><pre class="ranger-blog-pre">"resources": [
+ {
+ "itemId": 1,
+ "name": "database",
+ "parent": "",
+ "matcherOptions": { "wildCard": true, "ignoreCase": true },
+ "label": "Hive Database",
+ "isValidLeaf": true
+ },
+ {
+ "itemId": 2,
+ "name": "table",
+ "parent": "database",
+ "matcherOptions": { "wildCard": true, "ignoreCase": true },
+ "label": "Hive Table",
+ "isValidLeaf": true
+ },
+ {
+ "itemId": 3,
+ "name": "column",
+ "parent": "table",
+ "matcherOptions": { "wildCard": true, "ignoreCase": true },
+ "label": "Hive Column",
+ "isValidLeaf": true
+ }
+]</pre><h2>3.2 Access Types</h2><p>Access types define the operations that can appear in a Ranger policy. For example, here are few access types in Apache Hive service definition:</p><pre class="ranger-blog-pre">"accessTypes": [
+ { "itemId": 1, "name": "select", "label": "Select" },
+ { "itemId": 2, "name": "update", "label": "Update" },
+ { "itemId": 3, "name": "create", "label": "Create" },
+ { "itemId": 4, "name": "drop", "label": "Drop" },
+ { "itemId": 5, "name": "alter", "label": "Alter" },
+ { "itemId": 6, "name": "all", "label": "All",
+ "impliedGrants": [ "select", "update", "create", "drop", "alter" ]
+ }
+]</pre><p>impliedGrants enable grouping of multiple accessTypes with a logical name, such as all in the example above. Reference to an accessTypes in policies are equivalent to referencing all its impliedGrants.</p><h2>3.3 Data Masking</h2><p>A service can expose data-masking capabilities through the dataMaskDef section in its service definition. This section defines:</p><p class="ranger-blog__list-item">- resources to which masking can apply</p>
+ <p class="ranger-blog__list-item">- supported mask types</p>
+ <p class="ranger-blog__list-item">- access types for which masking is relevant</p><p>For example, here is a sample dataMaskDef section from Apache Hive service definition:</p><pre class="ranger-blog-pre">"dataMaskDef": {
+ "resources": [
+ {
+ "name": "database",
+ "matcherOptions": { "wildCard": "false" },
+ "uiHint": "{ \"singleValue\":true }"
+ },
+ {
+ "name": "table",
+ "matcherOptions": { "wildCard": "false" },
+ "uiHint": "{ \"singleValue\":true }"
+ },
+ {
+ "name": "column",
+ "matcherOptions": { "wildCard": "false" },
+ "uiHint": "{ \"singleValue\":true }"
+ }
+ ],
+ "maskTypes": [
+ {
+ "itemId": 1,
+ "name": "MASK",
+ "label": "Redact",
+ "transformer": "mask({col})"
+ },
+ {
+ "itemId": 2,
+ "name": "MASK_SHOW_LAST_4",
+ "label": "Partial mask: show last 4",
+ "transformer": "mask_show_last_n({col}, 4, 'x', 'x', 'x', -1, '1')"
+ },
+ {
+ "itemId": 3,
+ "name": "MASK_SHOW_FIRST_4",
+ "label": "Partial mask: show first 4",
+ "transformer": "mask_show_first_n({col}, 4, 'x', 'x', 'x', -1, '1')"
+ },
+ {
+ "itemId": 4,
+ "name": "MASK_HASH",
+ "label": "Hash",
+ "transformer": "mask_hash({col})"
+ },
+ {
+ "itemId": 5,
+ "name": "MASK_DATE_SHOW_YEAR",
+ "label": "Date: show only year",
+ "transformer": "mask({col}, 'x', 'x', 'x', -1, '1', 1, 0, -1)"
+ },
+ {
+ "itemId": 6,
+ "name": "MASK_NULL",
+ "label": "Nullify"
+ },
+ {
+ "itemId": 7,
+ "name": "MASK_NONE",
+ "label": "Unmasked (retain original value)"
+ },
+ {
+ "itemId": 8,
+ "name": "CUSTOM",
+ "label": "Custom"
+ }
+ ],
+ "accessTypes": [
+ { "name": "select" }
+ ]
+}</pre><h2>3.4 Row Filtering</h2><p>A service can expose row-filtering capabilities through the rowFilterDef section in its service definition. This section defines:</p><p class="ranger-blog__list-item">- Resources to which row-filtering can apply</p>
+ <p class="ranger-blog__list-item">- Access types for which row-filtering is relevant</p><p>For example, here is a sample rowFilterDef section from Apache Hive service definition:</p><pre class="ranger-blog-pre">"rowFilterDef": {
+ "resources": [
+ {
+ "name": "database",
+ "matcherOptions": { "wildCard": "false" },
+ "uiHint": "{ \"singleValue\":true }"
+ },
+ {
+ "name": "table",
+ "matcherOptions": { "wildCard": "false" },
+ "uiHint": "{ \"singleValue\":true }"
+ }
+ ],
+ "accessTypes": [
+ { "name": "select" }
+ ]
+}</pre><h2>3.5 Service Configurations</h2><p>A service definition can define configuration properties required to lookup resources in the application, for auto-completion in policy UI as users enter resource values. These configurations include the endpoint (JDBC, HTTP, ..) the application can be reached at, credentials to use while connecting to the application.</p><pre class="ranger-blog-pre">"configs": [
+ {
+ "itemId": 1,
+ "name": "username",
+ "type": "string",
+ "mandatory": true,
+ "label": "Username"
+ },
+ {
+ "itemId": 2,
+ "name": "password",
+ "type": "password",
+ "mandatory": true,
+ "label": "Password"
+ },
+ {
+ "itemId": 3,
+ "name": "jdbc.driverClassName",
+ "type": "string",
+ "mandatory": true,
+ "defaultValue": "org.apache.hive.jdbc.HiveDriver"
+ },
+ {
+ "itemId": 4,
+ "name": "jdbc.url",
+ "type": "string",
+ "mandatory": true,
+ "defaultValue": ""
+ }
+]</pre><h1 id="s4">4. Integration: Plugin</h1><p>Ranger plugin is the preferred integration mechanism for Java applications that want to perform authorization locally i.e. in-process. The core APIs, including following classes, are provided by Ranger libraries <a href="https://mvnrepository.com/artifact/org.apache.ranger/ranger-authz-api">org.apache.ranger:ranger-authz-api</a> and <a href="https://mvnrepository.com/artifact/org.apache.ranger/authz-embedded">org.apache.ranger:authz-embedd [...]
+org.apache.ranger.authz.embedded.RangerEmbeddedAuthorizer
+org.apache.ranger.authz.model.RangerAccessContext
+org.apache.ranger.authz.model.RangerAccessInfo
+org.apache.ranger.authz.model.RangerAuthzRequest
+org.apache.ranger.authz.model.RangerAuthzResult
+org.apache.ranger.authz.model.RangerAuthzResult.AccessDecision
+org.apache.ranger.authz.model.RangerUserInfo</pre><h2>4.1 Initializing the Plugin</h2><p>Ranger plugin instance is typically created and initialized during initialization of the application. Here is an example of Polaris plugin initialization:</p><pre class="ranger-blog-pre">RangerAuthorizer authorizer = new RangerEmbeddedAuthorizer(properties);
+authorizer.init();</pre><p>Ranger plugin downloads policies from Ranger admin server during initialization, builds a policy engine in-memory for faster evaluation. The plugin periodically polls the Ranger admin server, asynchronously, for any policy changes and keeps its policy engine updated.</p><h2>4.2 Creating an Authorization Request</h2><p>The application converts its native access request into a Ranger authorization request. For example:</p><pre class="ranger-blog-pre">String [...]
+RangerUserInfo user = new RangerUserInfo("alice");
+RangerAccessInfo access = new RangerAccessInfo(table, "QUERY", "select");
+RangerAccessContext ctx = new RangerAccessContext("trino", "sales_trino");
+RangerAuthzRequest request = new RangerAuthzRequest(user, access, ctx);</pre><p>Notes:</p><p class="ranger-blog__list-item">- <samp>alice</samp>, the username referenced must represent the authenticated caller of the application.</p>
+ <p class="ranger-blog__list-item">- <samp>trino</samp>, the serviceType referenced is the name of the service-definition registered with Ranger.</p>
+ <p class="ranger-blog__list-item">- <samp>select</samp>, the permission referenced must be one of accessTypes in the service-definition.</p>
+ <p class="ranger-blog__list-item">- <samp>sales_trino</samp>, the serviceName referenced represents a deployment of the Trino application. Remember, Ranger can support multiple deployments of an application type, such as <samp>marketing_trino</samp>, <samp>support_trino</samp>, <samp>test_trino</samp> - each with a different set of policies, policy administrators.</p><p>Additional information can be included in the authorization request, for example:</p><p>Context can include the [...]
+ <p class="ranger-blog__list-item">- client type</p>
+ <p class="ranger-blog__list-item">- request time</p>
+ <p class="ranger-blog__list-item">- cluster name</p><p>User can include the following:</p><p class="ranger-blog__list-item">- groups the user belongs to</p>
+ <p class="ranger-blog__list-item">- user attributes, like department, location</p><p>Resource can include the following:</p><p class="ranger-blog__list-item">- subResources, such as column names</p>
+ <p class="ranger-blog__list-item">- resource attributes, such as OWNER</p>
+ <p class="ranger-blog__list-item">- matchingScope, such as SELF, SELF_OR_ANY_DESCENDANT</p><h2>4.3 Evaluating the Request</h2><p>The plugin evaluates the request:</p><pre class="ranger-blog-pre">RangerAuthzResult result = authorizer.authorize(request);</pre>
+ <p>The result contains the authorization decision and additional information that can be used by the application or audit subsystem.</p><p>When the result doesn’t allow the requested access, applications should treat it as an authorization failure and must enforce that decision before accessing the protected resource.</p><pre class="ranger-blog-pre">if (!AccessDecision.ALLOW.equals(result.getDecision())) {
+ throw new AccessDeniedException();
+}</pre><p>When the result includes masking and/or row-filter expression, the application must include these into the query before executing.</p><pre class="ranger-blog-pre">RowFilterResult rowFilter = result.getPermissions("select").getRowFilter();
+
+if (rowFilter != null && StringUtils.isNotBlank(rowFilter.getFilterExpr())) {
+ // application must include the returned filter expression into the query
+}
+
+DataMaskResult dataMask = result.getPermissions("select").getDataMask();
+
+if (dataMask != null && StringUtils.isNotBlank(dataMask.getMaskType())) {
+ // application must apply the returned data mask expression into the query
+}</pre><p>authorize() method is thread-safe, hence can be called from multiple threads simultaneously.</p><h2>4.4 Plugin Configuration</h2><p>Ranger plugin requires configuration identifying:</p><p class="ranger-blog__list-item">- Ranger Admin endpoint</p>
+ <p class="ranger-blog__list-item">- Policy refresh settings</p>
+ <p class="ranger-blog__list-item">- Authentication configuration</p>
+ <p class="ranger-blog__list-item">- Audit configuration</p><p>Depending on the Ranger version and deployment configuration, the plugin's Ranger Admin client can use authentication mechanisms such as Basic authentication, JWT, or Kerberos, together with SSL/TLS.</p><p>A typical deployment would include following configurations:</p><pre class="ranger-blog-pre">ranger.authz.service.sales_trino.policy.rest.url=https://ranger.example.com
+ranger.authz.service.sales_trino.policy.pollIntervalMs=30000
+ranger.authz.service.sales_trino.policy.cache.dir=/etc/trino/policy_cache
+# Choose the authentication mechanism appropriate for the deployment
+# Basic authentication
+ranger.authz.service.sales_trino.policy.rest.client.username=
+ranger.authz.service.sales_trino.policy.rest.client.password=</pre><pre class="ranger-blog-pre"># JWT authentication
+ranger.authz.service.sales_trino.policy.rest.client.jwt.source=env|file|cred
+ranger.authz.service.sales_trino.policy.rest.client.jwt.env=TRINO_JWT
+ranger.authz.service.sales_trino.policy.rest.client.jwt.file=/etc/trino/trino.jwt
+ranger.authz.service.sales_trino.policy.rest.client.jwt.cred.file=
+ranger.authz.service.sales_trino.policy.rest.client.jwt.cred.alias=
+# Kerberos authentication
+ranger.authz.service.sales_trino.ugi.initialize=true
+ranger.authz.service.sales_trino.ugi.login.type=keytab
+ranger.authz.service.sales_trino.ugi.keytab.principal=trino@MYDOMAIN.COM
+ranger.authz.service.sales_trino.ugi.keytab.file=/etc/keytabs/trino.keytab</pre><pre class="ranger-blog-pre"># audit configuration
+ranger.authz.audit.is.enabled=true
+ranger.authz.audit.destination.solr=true
+ranger.authz.audit.destination.solr.urls=
+ranger.authz.audit.destination.hdfs=true
+ranger.authz.audit.destination.hdfs.dir=</pre><h2>4.5 Existing Authorizer Implementations</h2><p>Several complete authorizer implementations are available in Apache Ranger repository and other application repositories. Here are a few that can be good references for anyone looking to use the Ranger plugin approach.</p><p>API version note: Apache Ranger currently has two integration patterns in use. The newer authorization API introduced in Apache Ranger 2.9.0 uses authz-api/authz-embedded [...]
+ <tr>
+ <td><p><b>Application</b></p></td>
+ <td><p><b>Implementation Classes</b></p></td>
+ <td><p><b>Notes</b></p></td>
+ </tr>
+ <tr>
+ <td><p>Polaris</p></td>
+ <td><p><a href="https://github.com/apache/polaris/blob/main/extensions/auth/ranger/src/main/java/org/apache/polaris/extension/auth/ranger/RangerPolarisAuthorizer.java">RangerPolarisAuthorizer</a></p></td>
+ <td><p>Iceberg catalog authorization</p></td>
+ </tr>
+ <tr>
+ <td><p>Trino</p></td>
+ <td><p><a href="https://github.com/trinodb/trino/blob/master/plugin/trino-ranger/src/main/java/io/trino/plugin/ranger/RangerSystemAccessControl.java">RangerSystemAccessControl</a></p></td>
+ <td><p>SQL engine authorization, column-masking, row-filtering</p></td>
+ </tr>
+ <tr>
+ <td><p>HDFS</p></td>
+ <td><p><a href="https://github.com/apache/ranger/blob/master/hdfs-agent/src/main/java/org/apache/ranger/authorization/hadoop/RangerHdfsAuthorizer.java">RangerHdfsAuthorizer</a></p></td>
+ <td><p>Authorize access to path resources</p></td>
+ </tr>
+ <tr>
+ <td><p>Ozone</p></td>
+ <td><p><a href="https://github.com/apache/ranger/blob/master/plugin-ozone/src/main/java/org/apache/ranger/authorization/ozone/authorizer/RangerOzoneAuthorizer.java">RangerOzoneAuthorizer</a></p></td>
+ <td><p>Relatively compact RangerBasePlugin integration</p></td>
+ </tr>
+ <tr>
+ <td><p>Hive</p></td>
+ <td><p><a href="https://github.com/apache/ranger/blob/master/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizer.java">RangerHiveAuthorizer</a></p></td>
+ <td><p>Authorize access to hierarchical resources, resource filtering, column masking, row filtering</p></td>
+ </tr>
+ <tr>
+ <td><p>HBase</p></td>
+ <td><p><a href="https://github.com/apache/ranger/blob/master/hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessor.java">RangerAuthorizationCoprocessor</a></p></td>
+ <td><p>Authorize access to columnar data</p></td>
+ </tr>
+ <tr>
+ <td><p>Kafka</p></td>
+ <td><p><a href="https://github.com/apache/ranger/blob/master/plugin-kafka/src/main/java/org/apache/ranger/authorization/kafka/authorizer/RangerKafkaAuthorizer.java">RangerKafkaAuthorizer</a></p></td>
+ <td><p>Authorize event streaming in Kafka</p></td>
+ </tr>
+ </table><h1 id="s5">5. Integration: PDP Server</h1><p>Ranger PDP server provides a remote authorization model, using REST APIs, for applications that can’t or don’t prefer embedding a Ranger authorizer. For example:</p><p class="ranger-blog__list-item">- The application is not written in Java.</p>
+ <p class="ranger-blog__list-item">- Embedding Ranger plugin Java libraries is undesirable or not feasible.</p>
+ <p class="ranger-blog__list-item">- A small client-side footprint is preferred.</p><p>The tradeoff is that each authorization request involves communication with the Ranger PDP server via REST APIs. Applications should therefore consider latency, availability, connection management, and timeout behavior. Unlike embedded plugin authorization, remote authorization introduces a network dependency into the authorization path. An application must define how it behaves when the PDP is [...]
+ <p class="ranger-blog__list-item">- Java applications can use Java APIs in <a href="https://mvnrepository.com/artifact/org.apache.ranger/authz-remote">org.apache.ranger:authz-remote</a> library.</p>
+ <p class="ranger-blog__list-item">- Python applications can use Python APIs in <a href="https://pypi.org/project/apache-ranger/">apache-ranger</a> library.</p><h2>5.1 PDP REST APIs</h2><p>Applications that prefer a minimal footprint in using Ranger policies to authorize access should consider directly calling REST APIs provided by Ranger PDP server. The PDP request contains essentially the same authorization information used by the embedded plugin:</p><p class="ranger-blog__list [...]
+ <p class="ranger-blog__list-item">- resource</p>
+ <p class="ranger-blog__list-item">- permissions (access types defined in service definitions)</p>
+ <p class="ranger-blog__list-item">- context</p><pre class="ranger-blog-pre">For example:
+POST /v1/authorize
+{
+ "user": { "name": "alice" },
+ "access": {
+ "resource": { "name": "table:sales/customers/accounts" },
+ "action": "QUERY",
+ "permissions": [ "select" ]
+ },
+ "context": {
+ "serviceType": "trino",
+ "serviceName": "sales_trino"
+ }
+}</pre><p>Response:</p><pre class="ranger-blog-pre">{
+ "decision": "ALLOW"
+}</pre>
+ <p>Ranger PDP server evaluates the request against the applicable Ranger policies and returns the authorization result. The exact wire format should follow the PDP API supported by the Ranger version being deployed.</p><p>Note that only trusted users, as configured in PDP server, are allowed the following:</p><p class="ranger-blog__list-item">1. authorize for other users i.e, "user.name" is different from the caller</p>
+ <p class="ranger-blog__list-item">2. provide groups the user belongs to</p>
+ <p class="ranger-blog__list-item">3. provide attributes of the user or the resource</p><p>This distinction is important because the PDP server must not blindly trust a caller to assert another user's identity, groups, or attributes. Such fields should only be accepted from callers that are explicitly trusted by the PDP configuration.</p><h2>5.2 PDP Java APIs</h2><p>Ranger PDP client Java APIs provide convenient wrappers over corresponding Ranger PDP REST APIs. These are provided [...]
+RangerAuthorizer authorizer = new RangerRemoteAuthorizer(properties);</pre><pre class="ranger-blog-pre">authorizer.init();</pre><pre class="ranger-blog-pre">// authorize an access
+String table = "table:sales/customers/accounts";
+RangerUserInfo user = new RangerUserInfo("alice");
+RangerAccessInfo access = new RangerAccessInfo(table, "QUERY", "select");
+RangerAccessContext ctx = new RangerAccessContext("trino", "sales_trino");
+
+RangerAuthzRequest request = new RangerAuthzRequest(user, access, ctx);
+
+RangerAuthzResult result = authorizer.authorize(request);</pre><pre class="ranger-blog-pre">if (!AccessDecision.ALLOW.equals(result.getDecision())) {
+ throw new AccessDeniedException();
+}
+
+RowFilterResult rowFilter = result.getPermissions("select").getRowFilter();
+
+if (rowFilter != null && StringUtils.isNotBlank(rowFilter.getFilterExpr())) {
+ // application must include the returned filter expression into the query
+}
+
+DataMaskResult dataMask = result.getPermissions("select").getDataMask();
+
+if (dataMask != null && StringUtils.isNotBlank(dataMask.getMaskType())) {
+ // application must apply the returned data mask expression into the query
+}</pre><p>Configurations to connect to Ranger PDP server, including authentication details, must be populated in properties referenced above:</p><pre class="ranger-blog-pre">ranger.authz.remote.pdp.url=https://ranger-pdp.example.com
+ranger.authz.remote.authn.type=jwt|kerberos|header
+ranger.authz.remote.authn.jwt.source=
+ranger.authz.remote.authn.jwt.env=
+ranger.authz.remote.authn.kerberos.principal=
+ranger.authz.remote.authn.kerberos.keytab=
+ranger.authz.remote.authn.header.<trusted-header>=</pre><h2>5.3 PDP Python APIs</h2><p>Ranger PDP Python APIs are provided by RangerPdpClient class in <a href="https://pypi.org/project/apache-ranger/">apache-ranger</a> library.</p><p>Here is an example of PDP Python APIs to authorize access to Hive table:</p><pre class="ranger-blog-pre">from apache_ranger.client.ranger_pdp_client import RangerPDPClient
+from apache_ranger.model.ranger_authz import (
+RangerAccessContext,
+RangerAccessInfo,
+RangerAuthzRequest,
+RangerResourceInfo,
+RangerUserInfo,
+)
+from requests_kerberos import HTTPKerberosAuth</pre><pre class="ranger-blog-pre">pdp = RangerPDPClient("https://ranger-pdp.example.com", auth=HTTPKerberosAuth())</pre><pre class="ranger-blog-pre">user = RangerUserInfo({"name": "alice"})
+resource = RangerResourceInfo({"name": "table:sales/customers/accounts"})
+access = RangerAccessInfo({"resource": resource,
+ "action": "QUERY",
+ "permissions": [ "select" ]})
+
+ctx = RangerAccessContext({"serviceType": "trino", "serviceName": "sales_trino"})</pre><pre class="ranger-blog-pre">req = RangerAuthzRequest({"user": user, "access": access, "context": ctx })
+res = pdp.authorize(req)</pre><pre class="ranger-blog-pre">print(res.decision)</pre><h1 id="s6">6. Policy Administration</h1><p>Before an application can use Ranger policies, the Ranger service corresponding to the application must be registered and configured. This involves three administrative steps.</p><h2>6.1 Register service definition</h2><p>The application's service definition must first be registered with Ranger Admin. The service definition describes the application's authorizat [...]
+ <p class="ranger-blog__list-item">- access types</p>
+ <p class="ranger-blog__list-item">- data-masking capabilities</p>
+ <p class="ranger-blog__list-item">- row-filtering capabilities</p>
+ <p class="ranger-blog__list-item">- configuration properties used by the service</p><p>Registering, updating, or deleting a service definition requires Ranger administrator privileges. Typically, the application/integration developer provides the service definition, while a Ranger administrator registers it in the Ranger Admin service. Another option is to include the service definition in Apache Ranger git repository, which will be loaded by Ranger admin service during its initi [...]
+Services: dev_trino, prod_trino, sales_trino, mktg_trino</pre><p>Creating a Ranger service requires Ranger administrator privileges. When creating a service, the administrator provides application specific configurations, including the details required by Ranger admin to connect to the application for resource lookup. Following configurations can be used to specify list of users and groups whose members can create, update, delete, and read policies for the service:</p><pre clas [...]
+service.admin.groups</pre><h2>6.3 Delegated policy administration</h2><p>Ranger supports delegated administration, which allows policy management privileges to be restricted to a subset of resources and permissions within a service. For example, consider prod_hive service containing resources from several business domains:</p><pre class="ranger-blog-pre">prod_hive
+ |
+ |--- finance
+ | +-- payroll
+ | +-- expenses
+ |
+ |___ hr
+ | +-- employees
+ | +-- benefits</pre><p>A service administrator can create a policy with delegated-administration privileges for the contents of a database named finance, granting users in the finance-admin group permission to manage policies. Users in the finance-admin group can then create and modify policies for resources within their delegated resource and permissions scope only.</p><h2>6.4 Roles</h2><p>Ranger supports roles as a way to manage grants to a set of users and groups. A role can con [...]
+ |
+ +-- add group analysts
+ +-- add group reporting users
+
+sales-data-writer
+ |
+ +-- add group data-engineers</pre><p>A user with service policy administrator privileges can grant permissions a role:</p><pre class="ranger-blog-pre">sales-data
+ |
+ +-- grant read permission to sales-data-reader and sales-data-writer
+ +-- grant write permission to sales-data-writer</pre><p>The application does not need to implement role evaluation itself. Ranger evaluates the roles associated with the requesting user when determining whether an access request is allowed.</p><h2>6.5 Security Zones</h2><p>For larger deployments, Ranger can also organize services and resources into <a href="https://cwiki.apache.org/confluence/display/RANGER/Introduction+of+Security+Zones+in+Ranger">security zones</a>. A security zo [...]
+ <p class="ranger-blog__list-item">-<a href="https://cwiki.apache.org/confluence/display/RANGER/Ranger+Client+Libraries">Apache Ranger: Java client libraries</a></p>
+ <p class="ranger-blog__list-item">-<a href="https://pypi.org/project/apache-ranger/">Apache Ranger: Python client library</a></p>
+ <p class="ranger-blog__list-item">-<a href="https://ranger.apache.org/apidocs/index.html">Apache Ranger: REST API documentation</a></p>
+ <p class="ranger-blog__list-item">-<a href="https://cwiki.apache.org/confluence/display/RANGER/Introduction+of+Security+Zones+in+Ranger">Apache Ranger: security zones</a></p>
+ <p class="ranger-blog__list-item">-<a href="https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=65868896">Apache Ranger: row-filter and data-masking policies</a></p>
+ <p class="ranger-blog__list-item">-<a href="policy_model.html">Apache Ranger Policy Model</a></p></div>
+</div>
+ </section>
+ </body>
+</document>
diff --git a/docs/src/site/xdoc/blogs/policy_model.xml b/docs/src/site/xdoc/blogs/policy_model.xml
new file mode 100644
index 000000000..362e1c238
--- /dev/null
+++ b/docs/src/site/xdoc/blogs/policy_model.xml
@@ -0,0 +1,529 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<document>
+ <head>
+ <link href="../css/custom.css" rel="stylesheet"/>
+ </head>
+ <body>
+ <section name="Apache Ranger Policy Model">
+<div class="ranger-blog-post">
+<div class="ranger-blog__header">
+ <p class="ranger-blog__back"><a href="../blogs.html">← All blogs</a></p>
+<p class="ranger-blog__meta">Madhan Neethiraj, Apache Ranger committer · Mar 08, 2022</p>
+ </div>
+<div class="ranger-blog__body">
+ <h1>Introduction</h1>
+
+ <p>
+ Apache Ranger is an extensible framework that enables enterprises to adopt a consistent approach to authorize
+ access to their resources across multiple services/applications/cloud. Apache Ranger framework also enables
+ enterprises to collect audit logs of access to their resources, to help meet various compliance requirements.
+ </p><p>
+ Apache Ranger is a central part of security in many large deployments in enterprises across various domains
+ like finance, retail, insurance, healthcare, services. Apache Ranger has out-of-the box support for a large
+ number of popular services and many more services are supported by commercial vendors. Apache Ranger is highly
+ optimized for performance, adds negligible overhead in authorizing access to resources. It has been very well
+ proven in very high throughput services like Apache Kafka, Apache HBase which perform thousands of
+ authorizations per second.
+ </p><p>
+ Apache Ranger provides an intuitive web user interface to manage authorization policies and audit logs for
+ access to resources across a large number of services. Apache Ranger also provides REST, Python, Java APIs for
+ programmatic integration with tools used by enterprises. Open framework provided by Apache Ranger enables
+ enterprises to extend Apache Ranger authorization to their own applications and services as well.
+ </p><p>
+ Here are few key points that make Apache Ranger a compelling option for enterprises looking to standardize
+ authorization of access to their resources:
+ </p>
+
+ <p class="ranger-blog__list-item">1. out-of-the-box support for more than a dozen popular services like Apache Hive, Apache HBase, Apache Kafka, Apache Solr, Elasticsearch, Apache NiFi and Presto.</p>
+
+ <p class="ranger-blog__list-item">2. support for services like Amazon EMR, AWS S3, ADLS-Gen2, GCS, Snowflake, Google BigQuery, Trino, Dremio, Starburst, Apache Impala, Postgres, MS-SQL and Amazon Redshift by commercial vendors.</p>
+
+ <p class="ranger-blog__list-item">3. policies for access authorization, row-filters, data masking.</p>
+
+ <p class="ranger-blog__list-item">4. resource-based, classification-based policies, role-based, attribute-based policies.</p>
+
+ <p class="ranger-blog__list-item">5. delegated administration, deny and exceptions in policies, custom conditions.</p>
+
+ <p class="ranger-blog__list-item">6. centralized audit logs of accesses to enterprise resources across multiple services, interactive user interface to view audit logs of accesses.</p>
+
+ <p class="ranger-blog__list-item">7. intuitive policy management UI.</p>
+
+ <p class="ranger-blog__list-item">8. Java, Python, REST APIs for programmatic integration for policy management.</p>
+
+ <p class="ranger-blog__list-item">9. open framework which enables enterprises to extend Apache Ranger authorization to their own applications and services.</p>
+
+ <h2>Contents</h2>
+ <p><a href="#s1">1. Policy Model</a></p>
+ <p><a href="#s2">2. Attribute based access control</a></p>
+ <p><a href="#s3">3. Resource based access control</a></p>
+ <p><a href="#s4">4. Tag based access control</a></p>
+ <p><a href="#s5">5. Data masking</a></p>
+ <p><a href="#s6">6. Row-filter</a></p>
+ <p><a href="#s7">7. Access audit logs</a></p>
+ <p><a href="#references">References</a></p>
+
+ <h1 id="s1">Policy Model</h1>
+
+ <p>
+ At the core of Apache Ranger authorization is its policy model. We will go through key aspects of the Apache
+ Ranger policy model in this section.
+ </p>
+
+ <h2>Resources</h2>
+ <p>
+ A resource is a fundamental element in the Apache Ranger policy model. Apache Ranger enables policies to
+ authorize access to resources. In this context, a resource is anything whose access needs to be authorized,
+ like a file/path, database, table, column, topic; but can also be a service – like Apache Knox topology.
+ Apache Ranger policy model captures details of resources of a service in a declarative way – details like
+ hierarchy, case-sensitivity, supports row-filter/data-masking, etc.
+ </p><p>
+ Type of resources vary across services/applications, as seen in the table below:
+ </p><table>
+ <tr>
+ <td><p><b>Service</b></p></td>
+ <td><p><b>Resources</b></p></td>
+ </tr>
+ <tr>
+ <td><p>Apache Hive</p></td>
+ <td><p>databases, tables, columns, udfs</p></td>
+ </tr>
+ <tr>
+ <td><p>Apache Kafka</p></td>
+ <td><p>topics</p></td>
+ </tr>
+ <tr>
+ <td><p>Apache Solr</p></td>
+ <td><p>collections</p></td>
+ </tr>
+ <tr>
+ <td><p>AWS S3</p></td>
+ <td><p>buckets, objects</p></td>
+ </tr>
+ <tr>
+ <td><p>ADLS-Gen2</p></td>
+ <td><p>storage-accounts, containers, objects</p></td>
+ </tr>
+ <tr>
+ <td><p>Azure PowerBI</p></td>
+ <td><p>workspaces</p></td>
+ </tr>
+ <tr>
+ <td><p>Google BigQuery</p></td>
+ <td><p>projects, datasets, tables, columns</p></td>
+ </tr>
+ <tr>
+ <td><p>Snowflake</p></td>
+ <td><p>databases, schemas, tables, columns, warehouses</p></td>
+ </tr>
+ <tr>
+ <td><p>Trino</p></td>
+ <td><p>catalogs, schemas, tables, columns, procedures</p></td>
+ </tr>
+ <tr>
+ <td><p>...</p></td>
+ <td></td>
+ </tr>
+ </table>
+
+ <h2>Permissions</h2>
+ <p>
+ A permission is another fundamental element in the Apache Ranger policy model. A permission is an action
+ performed on a resource, like reading a file, creating a directory, querying a table, or publishing a message
+ to a topic. Apache Ranger policy model captures details of permissions of a service in a declarative way –
+ details like which permissions are applicable to specific resource types, implied permissions, etc.
+ </p><p>
+ Like resources, list of permissions varies across services/applications, as seen in the table below:
+ </p><table>
+ <tr>
+ <td><p><b>Service</b></p></td>
+ <td><p><b>Permissions</b></p></td>
+ </tr>
+ <tr>
+ <td><p>Apache Hive</p></td>
+ <td><p>create, alter, drop, select, insert, ..</p></td>
+ </tr>
+ <tr>
+ <td><p>Apache Kafka</p></td>
+ <td><p>publish, consume, create, delete, describe, configure, ..</p></td>
+ </tr>
+ <tr>
+ <td><p>Apache Solr</p></td>
+ <td><p>query, update, others, Solr admin</p></td>
+ </tr>
+ <tr>
+ <td><p>AWS S3</p></td>
+ <td><p>read, write, delete, ..</p></td>
+ </tr>
+ <tr>
+ <td><p>ADLS-Gen2</p></td>
+ <td><p>read, write, delete, ..</p></td>
+ </tr>
+ <tr>
+ <td><p>Azure PowerBI</p></td>
+ <td><p>contributor, member, admin, none</p></td>
+ </tr>
+ <tr>
+ <td><p>Google BigQuery</p></td>
+ <td><p>project-list, dataset-create, table-create, table-list, query, ..</p></td>
+ </tr>
+ <tr>
+ <td><p>Snowflake</p></td>
+ <td><p>CreateSchema, CreateTable, Select, Insert, Update, ..</p></td>
+ </tr>
+ <tr>
+ <td><p>Trino</p></td>
+ <td><p>create, alter, drop, select, insert, ..</p></td>
+ </tr>
+ <tr>
+ <td><p>...</p></td>
+ <td></td>
+ </tr>
+ </table>
+
+ <h2>Users, Groups, Roles</h2>
+ <p>
+ Apache Ranger enables authorization policies to be set up to allow/deny permissions to users, groups, and
+ roles. Users and groups are typically obtained from an enterprise directory like AD/LDAP. Apache Ranger
+ user-sync module handles details of bringing users and groups from sources like LDAP/AD/OS, and keeping up
+ with the changes in the sources - like addition of users and groups, addition/removal of a user from a group.
+ </p><p>
+ Apache Ranger user-sync supports retrieving attributes of users and groups as well. Such attributes, like
+ dept/location/site-id, can be used in authorization policies to allow/deny access to resources, and set up
+ row-filters that restrict users to access relevant subset of data. More on this later in this document.
+ </p><p>
+ In addition to users and groups, Apache Ranger supports roles to be used in authorization policies. A role in
+ Apache Ranger is a grouping of users, groups, and other roles. Roles can be managed using Apache Ranger UI and
+ REST APIs by authorized users. Role based authorization is widely used in enterprises and having support for
+ roles in Apache Ranger makes it possible to use well established enterprise security practices in Apache Ranger
+ authorization policies.
+ </p>
+
+ <h2>Delegated Admin</h2>
+ <p>
+ Apache Ranger enables decentralization of authorization policies management with support for delegated-admin
+ feature. A set of users, groups and roles can be granted permission, via an Apache Ranger policy (what else!),
+ to manage authorization policies for a subset of resources and permissions. For example, users in
+ <samp>finance-admin</samp> group can be granted permissions to manage authorization policies for contents of
+ Snowflake database named <samp>finance</samp>, and AWS S3 objects under <samp>s3://mybucket/dept/finance</samp>.
+ This offers a scalable approach to manage authorization in large deployments.
+ </p>
+
+ <h2>Security Zone</h2>
+ <p>
+ Apache Ranger supports security zones to enable multi-tenancy within an organization where admins from
+ different lines of businesses can manage security policies for their own resources. For example, data that
+ belongs to the sales team can be managed by administrators of the sales team, similarly data of marketing,
+ sales, operations teams can be managed by respective administrators.
+ </p><p>
+ Also, security zones can be used to isolate resources based on purpose. For example, it is common for a data
+ lake to have distinct areas and authorization policies for test data, unprocessed/raw data, semi-processed
+ data, and production data. Apache Ranger makes it easier to manage security policies in such deployments with
+ use of security zones like:
+ </p>
+ <p class="ranger-blog__list-item">-Test zone</p>
+ <p class="ranger-blog__list-item">-Landing zone</p>
+ <p class="ranger-blog__list-item">-Staging zone</p>
+ <p class="ranger-blog__list-item">-Production zone</p>
+ <p>
+ A security zone can contain resources from multiple services/applications, like AWS S3, ADLS-Gen2, GCS,
+ Snowflake, Amazon Redshift, Postgres, Apache Hadoop, Apache Hive, Apache HBase, Apache Kafka. This makes it
+ easier to set up consistent authorization policies across multiple services by a set of administrators
+ designated for each security zone.
+ </p>
+
+ <h2>Allow, Deny, Exceptions</h2>
+ <p>
+ In addition to authorization policies that can grant access to resources, Apache Ranger also enables policies
+ to be setup to:
+ </p>
+ <p class="ranger-blog__list-item">-deny access to users/groups/roles on resources</p>
+ <p class="ranger-blog__list-item">-exclude a subset of users from accesses allowed/denied above</p>
+ <p class="ranger-blog__list-item">-deny all access to specific resources other than the ones allowed in the policy</p>
+ <p>
+ This makes it easier to set up policies to protect sensitive resources.
+ </p>
+
+ <h2>Wildcards, macros, variables in resource names</h2>
+ <p>
+ Apache Ranger policies support use of wildcards, macros, and variables in resource names. This makes it
+ possible to use small number of policies for a large number of resources, as shown below:
+ </p><table>
+ <tr>
+ <td><p><b>Policy Resource</b></p></td>
+ <td><p><b>Description</b></p></td>
+ </tr>
+ <tr>
+ <td><p><samp>test_<b>*</b></samp></p></td>
+ <td><p>matches all resources having name that start with test_</p></td>
+ </tr>
+ <tr>
+ <td><p><samp>/home/<b>{USER}</b></samp></p></td>
+ <td><p>a path under /home having name of current user</p></td>
+ </tr>
+ <tr>
+ <td><p><samp>/dept/<b>${{USER.dept}}</b></samp></p></td>
+ <td><p>a path under /dept having name of current user’s department</p></td>
+ </tr>
+ </table><h2>Policy validity schedule</h2>
+ <p>
+ Apache Ranger enables policies to be effective only for specific time schedules. This feature can be used to
+ create policies that need to be effective at a future time, for example to allow access to revenue reports for
+ a wider audience only after a specific time. This feature can also be used to allow temporary access to
+ specific users/groups/roles, with a specific start and end times.
+ </p><h1 id="s2">Attribute based access control</h1>
+ <p>
+ Apache Ranger enables use of user, group, resource, classification, and the environment attributes in
+ authorization policies. ABAC makes it possible to express authorization policies without prior knowledge of
+ specific resources, specific users – which helps avoid the need for new policies as new resources or users are
+ introduced.
+ </p>
+ <br/>
+ <p>
+ For example:
+ </p>
+ <p class="ranger-blog__list-item">-allow each user to access all tables owned by them, using <b><i>{OWNER}</i></b> macro:</p>
+ <table class="ranger-blog-table--kv">
+ <tr>
+ <td><p><samp>resource</samp></p></td>
+ <td><p>database=*, table=*</p></td>
+ </tr>
+ <tr>
+ <td><p>users</p></td>
+ <td><p><b>{OWNER}</b></p></td>
+ </tr>
+ <tr>
+ <td><p>permissions</p></td>
+ <td><p>all</p></td>
+ </tr>
+ </table>
+ <p></p>
+ <p class="ranger-blog__list-item">-allow users to access their department data in AWS S3, by using user attribute <b><i>${{USER.dept}}</i></b>:</p>
+ <table class="ranger-blog-table--kv">
+ <tr>
+ <td><p><samp>resource</samp></p></td>
+ <td><p>bucket=mycompany, object=/data/<b><i>${{USER.dept}}</i></b>/*</p></td>
+ </tr>
+ <tr>
+ <td><p>users</p></td>
+ <td><p><b>{USER}</b></p></td>
+ </tr>
+ <tr>
+ <td><p>permissions</p></td>
+ <td><p>read,write</p></td>
+ </tr>
+ </table>
+ <p></p>
+ <p class="ranger-blog__list-item">-allow users in mktg group to access <samp>PII</samp> data of email type, by using tag attribute <b><i>TAG.piiType</i></b>:</p>
+ <table class="ranger-blog-table--kv">
+ <tr>
+ <td><p><samp>resource</samp></p></td>
+ <td><p>tag=PII</p></td>
+ </tr>
+ <tr>
+ <td><p>groups</p></td>
+ <td><p>mktg</p></td>
+ </tr>
+ <tr>
+ <td><p>condition</p></td>
+ <td><p><b><i>TAG.piiType == 'email'</i></b></p></td>
+ </tr>
+ <tr>
+ <td><p>permissions</p></td>
+ <td><p>select</p></td>
+ </tr>
+ </table>
+ <p></p>
+ <p class="ranger-blog__list-item">-tables with <samp>SENSITIVE</samp> classification should be accessible only by users having privileges for that sensitive level</p>
+ <table class="ranger-blog-table--kv">
+ <tr>
+ <td><p><samp>resource</samp></p></td>
+ <td><p>tag=SENSITIVE</p></td>
+ </tr>
+ <tr>
+ <td><p>groups</p></td>
+ <td><p>public</p></td>
+ </tr>
+ <tr>
+ <td><p>condition</p></td>
+ <td><p><b><i>TAG.sensitiveLevel < USER.allowedSensitiveLevel</i></b></p></td>
+ </tr>
+ <tr>
+ <td><p>permissions</p></td>
+ <td><p>select</p></td>
+ </tr>
+ </table>
+
+ <h1 id="s3">Resource based access control</h1>
+ <p>
+ Apache Ranger enables setting up policies to grant or deny permissions to users/group/roles based on specific
+ resource names, like:
+ </p>
+ <br/>
+
+ <table class="ranger-blog-table--resource">
+ <tr>
+ <td><p><b>Service</b></p></td>
+ <td><p><b>Resource</b></p></td>
+ <td><p><b>Permission</b></p></td>
+ </tr>
+ <tr>
+ <td><p>Apache Hive</p></td>
+ <td>
+ <table class="ranger-blog-table--kv">
+ <tr>
+ <td>database</td>
+ <td>sales</td>
+ </tr>
+ <tr>
+ <td>table</td>
+ <td>order_data</td>
+ </tr>
+ <tr>
+ <td>column</td>
+ <td>order_amount</td>
+ </tr>
+ </table>
+ </td>
+ <td><p>select</p></td>
+ </tr>
+ <tr>
+ <td><p>Apache Kafka</p></td>
+ <td>
+ <table class="ranger-blog-table--kv">
+ <tr>
+ <td>topic</td>
+ <td>finance</td>
+ </tr>
+ </table>
+ </td>
+ <td><p>publish, consume</p></td>
+ </tr>
+ <tr>
+ <td><p>AWS S3</p></td>
+ <td>
+ <table class="ranger-blog-table--kv">
+ <tr>
+ <td>bucket</td>
+ <td>mycompany</td>
+ </tr>
+ <tr>
+ <td>path</td>
+ <td>/home/{USER}</td>
+ </tr>
+ </table>
+ </td>
+ <td><p>read, write, delete</p></td>
+ </tr>
+ <tr>
+ <td><p>ADLS-Gen2</p></td>
+ <td>
+ <table class="ranger-blog-table--kv">
+ <tr>
+ <td>storage-account</td>
+ <td>mycompany</td>
+ </tr>
+ <tr>
+ <td>container</td>
+ <td>home</td>
+ </tr>
+ <tr>
+ <td>path</td>
+ <td>/{USER}</td>
+ </tr>
+ </table>
+ </td>
+ <td><p>read, write, delete</p></td>
+ </tr>
+ <tr>
+ <td><p>...</p></td>
+ <td></td>
+ <td></td>
+ </tr>
+ </table>
+
+ <h1 id="s4">Tag based access control</h1>
+ <p>
+ In addition to authorization policies on resources, Apache Ranger enables policies to be set up on
+ classifications (tags) associated with resources. This feature enables enterprises to separate responsibility
+ of classification of resources (PII, PCI, PHI, credit card number, etc.) from setting up access-control
+ policies. Classifications created, by a team of data stewards and tools that scan data for sensitive
+ information, can be leveraged to drive authorization to access the resources.
+ </p><p>
+ Authorization policies on the classifications themselves, instead of directly on the resources, will ensure
+ that appropriate policies will automatically be applied as classifications are added, removed, and updated on
+ resources. Also, a single tag-based policy (for example on PII) can be used to authorize access to resources
+ across multiple services like AWS S3, ADLS-Gen2, Snowflake, Databricks SQL, Apache Hive, Apache HBase, Apache
+ Kafka. This can significantly reduce the complexity in managing authorization policies.
+ </p>
+
+ <h1 id="s5">Data masking</h1>
+ <p>
+ Apache Ranger data-masking policies enable enterprises to allow access to sensitive data suitably masked
+ depending on the context in which a user accesses the data. Some users will need the data without masking,
+ while some other users can only be allowed to see partial or masked or transformed value. While authorization
+ policies can be used to either allow or deny access to certain data, data-masking policies enable dynamically
+ mask sensitive data as users access the data, for example to ensure that:
+ </p>
+ <p class="ranger-blog__list-item">-analysts have access to only specific part of birthday (year or month or day)</p>
+ <p class="ranger-blog__list-item">-only last 4 digits of a national id are available to customer service representatives</p>
+ <p class="ranger-blog__list-item">-only salary ranges of employees (i.e., not the salary) are available to analysts</p><p>
+ In addition to supporting data-masking policies on resources, like columns in Apache Hive/Snowflake/Databricks
+ SQL/Presto, Apache Ranger enables setting up data-masking policies based on classifications (tags) associated
+ with resources. This can significantly reduce the complexity in managing masking policies. In addition,
+ tag-based masking policies leverage classifications added to resources by data stewards and tools that scan
+ data for sensitive information.
+ </p>
+
+ <h1 id="s6">Row-filter</h1>
+ <p>
+ Apache Ranger row-filter policies enable enterprises to allow users to access only a subset of data depending
+ upon the context in which a user accesses the data. When a table having a row-filter is accessed by the user,
+ only a subset of rows will be visible to the user – depending upon the filter setup in row-filter policy.
+ Row-filters can be used for example to ensure that:
+ </p>
+ <p class="ranger-blog__list-item">-data of customers residing in a country is available only to analysts authorized to access the country’s data</p>
+ <p class="ranger-blog__list-item">-a store manager has access to only data relevant to the store she/he works in</p>
+ <p class="ranger-blog__list-item">-analysts don’t have access to sensitive records</p>
+
+ <h1 id="s7">Access audit logs</h1>
+ <p>
+ Apache Ranger generates audit logs of accesses to resources protected by Apache Ranger authorization. Apache
+ Ranger can be configured to store audit logs in multiple destinations, including Solr, HDFS, AWS S3, AWS
+ CloudWatch, ADLS-Gen2, Elasticsearch. Audit logs generated by Apache Ranger include following details, which
+ can help enterprises to satisfy various compliance requirements:
+ </p><p class="ranger-blog__list-item">-resource accessed; action performed; was access allowed</p>
+ <p class="ranger-blog__list-item">-time of access, tags associated with the resource (PII, PCI, PHI, ..)</p>
+ <p class="ranger-blog__list-item">-who performed the access, IP address from which the access was performed</p>
+ <p class="ranger-blog__list-item">-ID of Apache Ranger policy that allowed or denied the access</p><p>
+ Apache Ranger provides an interactive user interface to view audit logs stored in Solr, Elasticsearch or AWS
+ CloudWatch, with search capabilities to look for access audits for specific resources, specific users, client
+ IP addresses, within a given time frame, specific classifications. Apache Ranger audit logs can be stored in
+ ORC or JSON formats, which can then be loaded into various tools for analysis.
+ </p><h1 id="references">References</h1>
+ <p class="ranger-blog__list-item">-<a href="https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=61322361">Apache Ranger: tag-based policies</a></p>
+ <p class="ranger-blog__list-item">-<a href="https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=65868896">Apache Ranger: row-filter and data-masking policies</a></p>
+ <p class="ranger-blog__list-item">-<a href="https://cwiki.apache.org/confluence/display/RANGER/Introduction+of+Security+Zones+in+Ranger">Apache Ranger: security zones</a></p>
+ <p class="ranger-blog__list-item">-<a href="https://pypi.org/project/apache-ranger/">Apache Ranger: Python</a></p>
+ <p class="ranger-blog__list-item">-<a href="https://cwiki.apache.org/confluence/display/RANGER/Ranger+Client+Libraries">Apache Ranger: Java</a></p>
+ <p class="ranger-blog__list-item">-<a href="https://ranger.apache.org/apidocs/index.html">Apache Ranger: REST</a></p>
+ </div>
+</div>
+ </section>
+ </body>
+</document>