question Re: How to create many ranger policies and add users to them ? in Support Questions

How to create many ranger policies and add users to them ?

SK1 — Tue, 19 Sep 2017 19:58:09 GMT

We have requirement where we have to create more that 1000+ policies, so what is the easiest way to create these?

Also how to add users to each policies ?

Re: How to create many ranger policies and add users to them ?

anarasimham — Tue, 19 Sep 2017 20:31:35 GMT

The Ranger REST API is best to programmatically create users and policies.

Here's how to create users, from an article on this site:
https://community.hortonworks.com/content/supportkb/49439/how-to-use-api-curl-commands-to-create-internal-ra.html

Here's how to use the Ranger REST API to create policies:

https://cwiki.apache.org/confluence/display/RANGER/REST+APIs+for+Policy+Management

Please note the sections on Creating, Updating, Deleting policies.

To create for example, send a POST request to the following endpoint with the following body. This example is pulled from the link above.

POST /service/public/api/policy

{
  "policyName": "HomePolicy",
  "resourceName": "\/home,\/apps",
  "description": "Home",
  "repositoryName": "hadoopdev",
  "repositoryType": "hdfs",
  "isEnabled": "true",
  "isRecursive": false,
  "isAuditEnabled": true,
  "permMapList": [
    {
      "userList": [
        "john",
        "andrew"
      ],
      "permList": [
        "SELECT",
        "UPDATE"
      ]
    },
    {
      "userList": [
        "hr"
      ],
      "groupList": [
        "admin"
      ],
      "permList": [
        "DROP",
        "ALTER",
        "ADMIN"
      ]
    }
  ]
}

Re: How to create many ranger policies and add users to them ?

SK1 — Tue, 19 Sep 2017 20:42:12 GMT

@anarasimham: Thanks for your quick response. can you help me to get how to add many users to a specific policy or one user to many policy ?

Re: How to create many ranger policies and add users to them ?

anarasimham — Wed, 20 Sep 2017 01:44:52 GMT

Yes, you can add users to policies either through a CREATE or UPDATE as the second article above outlines. There is a parameter called 'userList' and you will be able to specify any number of users you'd like. To add one user to many policies, you will have to go one by one and add the user to each of the target policies.

Please refer to this link from above:

https://cwiki.apache.org/confluence/display/RANGER/REST+APIs+for+Policy+Management

Re: How to create many ranger policies and add users to them ?

akulkarni1 — Thu, 21 Sep 2017 01:18:57 GMT

Please use the following doc link. It documents the latest set of REST APIs supported by Ranger for policy management.

Thanks!

https://cwiki.apache.org/confluence/display/RANGER/Apache+Ranger+0.6+-+REST+APIs+for+Service+Definition%2C+Service+and+Policy+Management

Re: How to create many ranger policies and add users to them ?

SK1 — Fri, 22 Sep 2017 19:55:49 GMT

thanks @anarasimham.

Re: How to create many ranger policies and add users to them ?

shashant_panwar — Tue, 26 Sep 2017 01:31:07 GMT

@Saurabh: Why you want to create 1000+ policies? Can you try grouping the requirements and reduce the policies? Eg: achieve them via making user groups or DB level policies with different user permission set. Ranger API is def a solution for this but I would suggest to revisit the requirement and rule out as many duplicates as you can.

Just a suggestion, not saying your requirement is invalid!!!

Re: How to create many ranger policies and add users to them ?

srinivasp — Mon, 05 Jul 2021 11:58:32 GMT

Hi,

I have a requirement like, i need to create hive policy with two groups .one group with "ALL" permissions to some "x" user and 2nd group with "select" permission to "y" user.

i have created policy through REST APi with one group but with "all" permissions but how to mention 2nd group with "select" permission in same create policy command.

Thanks in advance!

Srini Podili