Can we do column value level restriction in Apache ranger ?

[#1]

Can we create policy for value of a selected column ( in a hive table ) in Ranger.

[#2 · Accepted solution]

@Dinesh Das

Yes. You can achieve this using ranger.

Please check - http://hortonworks.com/blog/best-practices-for-hive-authorization-using-apache-ranger-in-hdp-2-2/

[#3]

@Sagar Shimpi

Thank you, do you have the doc which lists all the functionalities of Ranger and ATLAS.

[#4]

You might be interested in

1. http://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.5.3/bk_data-governance/content/ch_hdp_data_gover...

2. http://hortonworks.com/hadoop-tutorial/tag-based-policies-atlas-ranger/

[#5]

@Dinesh Das

Row Filtering and Column masking are supported in Ranger. This may cater your use case of column value level restriction. Please check it out and let us know is this what you were looking for?

https://cwiki.apache.org/confluence/display/RANGER/Row-level+filtering+and+column-masking+using+Apac...

[#6]

@Ramesh Mani Sure, Thanks for the post let me try all these

[#7]

@Ramesh Mani

Restriction through Ranger is neither working on HIVE CLI nor BEELINE CLI. I can able to fetch full data when am using select command in hive/beeline cli . Its only working in Hive view. am I doing anything wrong here !?

[#8]

@Dinesh Das Ranger is not supported in HIVE CLI. What version of HDP are using? If Ranger Policy is not in effective may be the plugin is not enabled correctly or something wrong. Do you get any audit in Ranger admin? Also as @svenkat requested please provide your use case that will help us.

[#9]

@Ramesh Mani

Yes am able to do audit in ranger and am using HDP 2.5

[#10]

@Dinesh Das, can you explain what is your exact use case with one or more concrete examples of what you are trying to do exactly? Your problem statement is somewhat vague.

[#11]

@svenkat

Am trying to create a policy in ranger for restricting certain rows of a hive table, I found the policy is working well with hive view. But when am checking the same in hive CLI ( hive command prompt ) , seems the policy is not working I can able to see the restricted data and same scenario for beeline CLI as well.

[#12]

@Dinesh Das: Can you pls put screenshots of the policy(s) you are creating for the same. You will need an access level policy which will grant access to your user on the Hive resources and then a Row level filter policy if you want to filter out certain rows. Also what is the select statement you are using in beeline cli?