Hi Everyone, I have Ranger 2.4 installed. On the ranger ui, when I give a allow policy to my user, the policy is getting applied and my user is able to see the desired table. But when I give the same policy to a whole group instead of a single user, the users in that group are not able to see the desired table. Any idea how can I resolve this?
It is not Ranger's job to inform the client applications using Ranger what users belong to what group. Each client application is responsible for determining which groups the user authenticated into that service belong to.
The policies generated by Ranger are downloaded by the client applications. Within that downloaded policy json will be a resource identifier(s), list if user identities authorized (read, write, and/or delete) , and list of group identities authorized (read, write, or delete) against each resource identifier. So when client checks the downloaded policies from Ranger it is looking for the user identity being authorized and if client is aware of the group(s) that user belongs to, will also check authorization for that group identity.
so in your case, it i s most likely that your client service/application has not been configured with the same user and group association setup in your Ranger service.
If you found that the provided solution(s) assisted you with your query, please take a moment to login and click Accept as Solution below each response that helped.