question Ranger policies not getting applied on groups in Support Questions

Ranger policies not getting applied on groups

kothari — Mon, 21 Aug 2023 12:43:58 GMT

Hi Everyone,
I have Ranger 2.4 installed.
On the ranger ui, when I give a allow policy to my user, the policy is getting applied and my user is able to see the desired table. But when I give the same policy to a whole group instead of a single user, the users in that group are not able to see the desired table.
Any idea how can I resolve this?

Re: Ranger policies not getting applied on groups

steven-matison — Mon, 21 Aug 2023 14:00:02 GMT

@kothari here is a very good match with several comments w/ things you should check.

https://community.cloudera.com/t5/Support-Questions/Ranger-group-policy-not-being-applied-to-the-users-with-in/td-p/95972

To summarize:

Make sure user is in the AD group.
Make sure users and groups synced.
Check case sensitivity
Confirm ranger policies are correct.

Re: Ranger policies not getting applied on groups

DianaTorres — Thu, 24 Aug 2023 17:53:32 GMT

@kothari Has the reply helped resolve your issue? If so, please mark the appropriate reply as the solution, as it will make it easier for others to find the answer in the future. Thanks.

Re: Ranger policies not getting applied on groups

MattWho — Thu, 24 Aug 2023 19:31:34 GMT

@kothari

It is not Ranger's job to inform the client applications using Ranger what users belong to what group. Each client application is responsible for determining which groups the user authenticated into that service belong to.

The policies generated by Ranger are downloaded by the client applications. Within that downloaded policy json will be a resource identifier(s), list if user identities authorized (read, write, and/or delete) , and list of group identities authorized (read, write, or delete) against each resource identifier. So when client checks the downloaded policies from Ranger it is looking for the user identity being authorized and if client is aware of the group(s) that user belongs to, will also check authorization for that group identity.

so in your case, it i s most likely that your client service/application has not been configured with the same user and group association setup in your Ranger service.

If you found that the provided solution(s) assisted you with your query, please take a moment to login and click Accept as Solution below each response that helped.

Thank you,

Matt