Apache Ranger Access Conditions
The Apache Ranger access policy model consists of two major components: specification of the resources a policy is applied to, such as HDFS files and directories, Hive databases. tables. and columns, HBase tables, column-families, and columns, and so on; and the specification of access conditions for specific users and groups
Allow Deny and Exclude Conditions
Apache Ranger supports the following access conditions:
-
Allow
-
Exclude from Allow
-
Deny
-
Exclude from Deny
These access conditions enable you to set up fine-grained access control policies.
For example, you can allow access to a "finance" database to all users in the "finance" group, but deny access to all users in the "interns" group. Let's say that one of the members of the "interns" group, "scott", needs to work on an assignment that requires access to the "finance" database. In that case, you can add an Exclude from Deny condition that will allow user "scott" to access the "finance" database. The following image shows how this policy would be set up in Apache Ranger:
Enable Deny Conditions for Policies
- From Ambari>Ranger>Configs>Advanced>Custom ranger-admin-site,
add
ranger.servicedef.enableDenyAndExceptionsInPolicies=true. - Restart Ranger.
Policy Evaluation of Access Conditions
Apache Ranger policies are evaluated in a specific order to ensure predictable results (if there is no access policy that allows access, the authorization request will typically be denied). The following diagram shows the policy evaluation work-flow:
