What Ranger based authorization do I need to be able to grant privileges to others through grant command?

[#1]

As an example: I have a Hive policy granting 'user1' 'select' privilege on 'default,*,*' with delegate admin set to true. Can 'user1' now issue a grant command to give 'user2', 'create', 'update' and 'select' privileges on 'default,*,*' ? user1 itself does not have the privileges its granting to user2 on the resources. @vperiasamy

[#2]

In the above situation, I believe 'user1' will be able to grant to 'user2' any permissions, because delegate admin access is for the resources specified, not for the specific permissions.

@sneethiraj can offer more insights.

[#3 · Accepted solution]

I've just tried the scenario you described on HDP-2.5.3 (Ranger-0.6) and it works, my user1 has only "Select" privilege but could grant all privileges to user2, and he can even grant "all" to himself. I think the idea with "Delegate Admin" is that you can set certain user to be a Ranger admin on given resources. Though, I've never seen this well documented. And actually the User guide for Ranger-0.5 says that The delegated admin can update, delete the policies. It can also create child policies based on the original policy (base policy). So, if you want to avoid unexpected surprises you can disable "Delegate Admin" in all policies, and control everything by the central admin.