About "Delegate Admin" in Ranger

[#1]

About "Delegate admin" Ranger user guide says: When a policy is assigned to a user or a group of users those users become the delegated admin.The delegated admin can update, delete the policies. It can also create child policies based on the original policy (base policy). What exactly can be done? I'm assuming the delegated admin can only further reduce given permissions. Do we have any examples updating the policy and creating child policies.

[#2 · Accepted solution]

@Predrag Minovic

See this...In my case , I have a user called demouser and I have created a policy called policy1 and its delegated policy. When I login with user demouser in ranger then I can see policy1 but when I remove delegated option from policy1 then demouser cant see it.

You can see the demo here

[#3]

@Predrag Minovic It can do whatever the permissions you give to do. demouser can login and delegate other users

admin

demouser

[#4]

Thanks @Neeraj Sabharwal, that's cool! And per specs. What else can the demouser do as the delegated admin, can he add more paths? And how about child policies, can you try to create one? Tnx.

[#5]

@Predrag Minovic

demouser cannot add new policy for new paths but can add more paths under the main path.

[#6]

@Predrag Minovic Help me to close the thread by accepting the best answer if answer was helpful.

[#7]

@neeraj sabharwal

am not able to access demo video 😞

[#8]

There is no video, it's an animated gif, located here http://i.giphy.com/l4Ki1Ng3uxdTnUTra.gif

[#9]

Hello, From what version of Ranger this delegate admin feature is supported? This is a cool feature for multi-level provisioning powers