question Re: Can we do column value level restriction in Apache ranger ? in Archives of Support Questions (Read Only)

Can we do column value level restriction in Apache ranger ?

das_dineshk — Wed, 11 Jan 2017 22:09:56 GMT

Can we create policy for value of a selected column ( in a hive table ) in Ranger.

Re: Can we do column value level restriction in Apache ranger ?

sshimpi — Wed, 11 Jan 2017 22:11:52 GMT

@Dinesh Das

Yes. You can achieve this using ranger.

Please check - http://hortonworks.com/blog/best-practices-for-hive-authorization-using-apache-ranger-in-hdp-2-2/

Re: Can we do column value level restriction in Apache ranger ?

das_dineshk — Wed, 11 Jan 2017 22:36:56 GMT

@Sagar Shimpi

Thank you, do you have the doc which lists all the functionalities of Ranger and ATLAS.

Re: Can we do column value level restriction in Apache ranger ?

rmani — Thu, 12 Jan 2017 03:09:56 GMT

@Dinesh Das

Row Filtering and Column masking are supported in Ranger. This may cater your use case of column value level restriction. Please check it out and let us know is this what you were looking for?

https://cwiki.apache.org/confluence/display/RANGER/Row-level+filtering+and+column-masking+using+Apache+Ranger+policies+in+Apache+Hive

Re: Can we do column value level restriction in Apache ranger ?

ssainath — Thu, 12 Jan 2017 12:54:40 GMT

Re: Can we do column value level restriction in Apache ranger ?

das_dineshk — Thu, 12 Jan 2017 17:27:30 GMT

@Ramesh Mani Sure, Thanks for the post let me try all these

Re: Can we do column value level restriction in Apache ranger ?

das_dineshk — Thu, 12 Jan 2017 21:07:47 GMT

@Ramesh Mani

Restriction through Ranger is neither working on HIVE CLI nor BEELINE CLI. I can able to fetch full data when am using select command in hive/beeline cli . Its only working in Hive view. am I doing anything wrong here !?

Re: Can we do column value level restriction in Apache ranger ?

svenkat — Fri, 13 Jan 2017 06:04:19 GMT

@Dinesh Das, can you explain what is your exact use case with one or more concrete examples of what you are trying to do exactly? Your problem statement is somewhat vague.

Re: Can we do column value level restriction in Apache ranger ?

rmani — Fri, 13 Jan 2017 06:25:38 GMT

@Dinesh Das Ranger is not supported in HIVE CLI. What version of HDP are using? If Ranger Policy is not in effective may be the plugin is not enabled correctly or something wrong. Do you get any audit in Ranger admin? Also as @svenkat requested please provide your use case that will help us.

Re: Can we do column value level restriction in Apache ranger ?

das_dineshk — Mon, 16 Jan 2017 16:32:47 GMT

@svenkat

Am trying to create a policy in ranger for restricting certain rows of a hive table, I found the policy is working well with hive view. But when am checking the same in hive CLI ( hive command prompt ) , seems the policy is not working I can able to see the restricted data and same scenario for beeline CLI as well.

Re: Can we do column value level restriction in Apache ranger ?

das_dineshk — Mon, 16 Jan 2017 16:33:38 GMT

@Ramesh Mani

Yes am able to do audit in ranger and am using HDP 2.5

Re: Can we do column value level restriction in Apache ranger ?

aleekha — Fri, 03 Feb 2017 07:20:51 GMT

@Dinesh Das: Can you pls put screenshots of the policy(s) you are creating for the same. You will need an access level policy which will grant access to your user on the Hive resources and then a Row level filter policy if you want to filter out certain rows. Also what is the select statement you are using in beeline cli?