Adding a Ranger security zone

In Ranger Admin Web UI > Service Manager, click Security Zone.

Security Zone displays existing security zones. If no zone exists, two options for creating a new zone display.

On Security Zone, click + Create (new) Zone.

Create Zonedisplays options for creating a new security zone.

On Create Zone, enter the following information:

Table 1. Zone Details
Field	Description
Zone Name	The security zone name.
Zone Description	An optional description.

Table 2. Zone Administration
Field	Description
Admin Users	The Admin users for the security zone.
Admin Usergroups	The Admin user groups for the security zone.
Auditor Users	The Auditor users for the security zone.
Auditor Usergroups	The Auditor user groups for the security zone.

Table 3. Services
Label	Description
Select Tag Services	Select tag-based services for the security zone.
Select Resource Services	Select resource-based services for the security zone.

Selected services are listed in Services. To add resources for each selected service, click + in the Resource column for the applicable service.

Use Resource Details to specify resources for the service, then click Save.

Selected resources appear as Resources for each Service in Create Zone.

note

The solr plugin supports fine-grained authorization similar to legacy Sentry privileges. A part of this support introduces the following new solr resources: collection, config, schema and admin. To perform any operation on a collection, a user also requires admin-level permission. To create a security zone for with the solr service that includes a collection resource, you must also add an admin resource. Currently, if you use one solr service to create a security zone that has a collection resource (and therefore includes an admin resource) you cannot create another solr security zone using another collection. (currently, only one admin resource can be used per solr security zone). This limitation exists for security zones in cr-7.1.8.

Click Save at the bottom of Create Zone to save the new security zone.

The new security zone is listed on the Security Zone page.

To edit a security zone, click the security zone name in the Security Zones list, then click Edit.

After security zones have been created, you can use the Security Zone selection box on the Service Manager page to display the services assigned to the selected security zone. A Zone Name column appears in the table on Audit > Access, and also in Service Manager > Reports.