Permission models on Ozone

Ozone uses Access Control Lists (ACLs) to provide various access permissions to users. Learn about access controls and permissions in Cloudera-managed Ozone environments,

Ozone uses Access Control Lists (ACLs) to manage user permissions. While Apache Ozone supports two authorizer types, the native authorizer (built-in ACL support) and the Ranger authorizer (using Apache Ranger), Cloudera deployments support only the Ranger authorizer. Therefore, you must use Apache Ranger to define and manage access control policies in Cloudera-managed Ozone environments.

When a Ranger service dependency is configured for Ozone, the property ozone.acl.enabled is automatically set to true to enable ACL checks.

Considerations for using the authorizers

When using the Ranger authorizer to manage access control in Ozone, keep the following operational and administrative factors in mind:

If using the Ranger authorizer for Ozone, the only way you can set or change policies is by using the Ranger user interface and the Ranger REST API. Ozone does not enable you to update ACLs using its CLI when managed by Ranger.
Every volume has an owner, who has default permissions to all the entities within the volume. A volume can be created with another user as owner using a CLI flag.
By default, the Ozone Manager service user hdfs is the cluster administrator, and the only user with global access to all the volumes. The policy to provide the cluster administrator with the global access to all the volumes is a part of the default policies available with the Ozone-Ranger plug-in. Therefore, by default, only the om user can list volumes at the root level of ofs:// ( == list all volumes). You can add more users to this default Ozone policy in Ranger for admin access to Ozone.

Ranger authorizer

Cloudera recommends using the Ranger authorizer to manage access permissions for Ozone in Cloudera deployments. The Ozone-Ranger plug-in supports resources at the level of a volume or a bucket or a key, and the supported operations are similar to those of HDFS. You can use the Ozone-Ranger plug-in to configure policies at the level of a specific volume or a bucket or a key.

For more information, see Using Ranger with Ozone.