question Re: Atlas tag based policy not working on Sandbox 2.5 TP in Support Questions

Atlas tag based policy not working on Sandbox 2.5 TP

qiwang — Sun, 18 Aug 2019 11:16:04 GMT

I tried to follow the tutorial on the tag based policy in Atlas, but can't seem to make it work. Actually the tutorial itself seems to be misleading with the tag based policy.

In part 4, although it looks like the access is granted through the tag based policy by excluding admin user in deny access, it is not. Even I disable that tag based policy in Ranger, the access for admin user is still there. It is because the original 2 resource based policies are enabled which grant admin user all access. So with or without the tag based policy, the admin use always has access to the hive table.

I also tried is to modify the tag based policy in the tutorial so it blocks access for admin user by put the following in the deny conditions. And admin use still has access

Select Group – none
Select User – admin
Component Permission – Hive – Select
You can select the component permission through this popup:

All resourced based policy worked as expected and the problem only exist with tag related policy.

After some digging in Ranger audit, it seems that when tag related policy is created/changed, they were not synced to plug in, not sure if that is the reason behind the failure

You can see the sync only happened with resource based policies

Re: Atlas tag based policy not working on Sandbox 2.5 TP

svenkat — Fri, 05 Aug 2016 11:09:01 GMT

Please provide a screenshot of the Audit panel -> Access tab. You can check which policy is firing and allowing access for admin from the Audit screen in the Access tab. FYI, there is no separate plugin sync for tag based and resource based policies - if you have an entry for the hiveServer2 under plugin id column after you updated the policy that means all policies are synced.

Re: Atlas tag based policy not working on Sandbox 2.5 TP

qiwang — Sat, 06 Aug 2016 01:33:38 GMT

I always got "Unable to connect to Audit store !!" error in Audit=>Access tab. Nothing in that tab

Re: Atlas tag based policy not working on Sandbox 2.5 TP

mrizvi — Sat, 06 Aug 2016 06:06:50 GMT

@Qi Wang, let me check from my end, will keep u posted as early as possible

Re: Atlas tag based policy not working on Sandbox 2.5 TP

qiwang — Mon, 08 Aug 2016 09:21:02 GMT

I download the HDP2.5 TP Sandbox in early July. Not sure if there is newer version out after that.

Re: Atlas tag based policy not working on Sandbox 2.5 TP

qiwang — Wed, 02 Nov 2016 21:36:48 GMT

this is addressed in the latest sandbox, no an issue any more