question Re: What Ranger based authorization do I need to be able to grant privileges to others through grant command? in Support Questions

What Ranger based authorization do I need to be able to grant privileges to others through grant command?

aleekha — Thu, 02 Mar 2017 06:40:04 GMT

As an example: I have a Hive policy granting 'user1' 'select' privilege on 'default,*,*' with delegate admin set to true. Can 'user1' now issue a grant command to give 'user2', 'create', 'update' and 'select' privileges on 'default,*,*' ? user1 itself does not have the privileges its granting to user2 on the resources. @vperiasamy

Re: What Ranger based authorization do I need to be able to grant privileges to others through grant command?

vperiasamy — Thu, 02 Mar 2017 23:40:09 GMT

In the above situation, I believe 'user1' will be able to grant to 'user2' any permissions, because delegate admin access is for the resources specified, not for the specific permissions.

@sneethiraj can offer more insights.

Re: What Ranger based authorization do I need to be able to grant privileges to others through grant command?

pminovic — Fri, 03 Mar 2017 09:50:51 GMT

I've just tried the scenario you described on HDP-2.5.3 (Ranger-0.6) and it works, my user1 has only "Select" privilege but could grant all privileges to user2, and he can even grant "all" to himself. I think the idea with "Delegate Admin" is that you can set certain user to be a Ranger admin on given resources. Though, I've never seen this well documented. And actually the User guide for Ranger-0.5 says that The delegated admin can update, delete the policies. It can also create child policies based on the original policy (base policy). So, if you want to avoid unexpected surprises you can disable "Delegate Admin" in all policies, and control everything by the central admin.