Skip to main content
kothari
kothari
Bronze ⭐️⭐️⭐️
August 21, 2023
Solved

Ranger policies not getting applied on groups

Hi Everyone, 
I have Ranger 2.4 installed. 
On the ranger ui, when I give a allow policy to my user, the policy is getting applied and my user is able to see the desired table. But when I give the same policy to a whole group instead of a single user, the users in that group are not able to see the desired table.
Any idea how can I resolve this?

steven-matison
steven-matisonAnswer
Platinum ⭐️⭐️
August 21, 2023

@kothari   here is a very good match with several comments w/ things you should check.

 

https://community.cloudera.com/t5/Support-Questions/Ranger-group-policy-not-being-applied-to-the-users-with-in/td-p/95972


To summarize:

  1. Make sure user is in the AD group.
  2. Make sure users and groups synced.
  3. Check case sensitivity
  4. Confirm ranger policies are correct.
View in thread

3 replies

steven-matison
Platinum ⭐️⭐️
steven-matisonAnswer
Platinum ⭐️⭐️
August 21, 2023

@kothari   here is a very good match with several comments w/ things you should check.

 

https://community.cloudera.com/t5/Support-Questions/Ranger-group-policy-not-being-applied-to-the-users-with-in/td-p/95972


To summarize:

  1. Make sure user is in the AD group.
  2. Make sure users and groups synced.
  3. Check case sensitivity
  4. Confirm ranger policies are correct.
Translate
DianaTorres
Community Manager
DianaTorres
Community Manager
August 24, 2023

@kothari Has the reply helped resolve your issue? If so, please mark the appropriate reply as the solution, as it will make it easier for others to find the answer in the future. Thanks.

Translate
Regards, Diana Torres, Senior Community Moderator
MattWho
Titanium ⭐️⭐️⭐️
MattWho
Titanium ⭐️⭐️⭐️
August 24, 2023

@kothari 

It is not Ranger's job to inform the client applications using Ranger what users belong to what group.  Each client application is responsible for determining which groups the user authenticated into that service belong to.

The policies generated by Ranger are downloaded by the client applications.  Within that downloaded policy json will be a resource identifier(s), list if user identities authorized (read, write, and/or delete) , and list of group identities authorized (read, write, or delete) against each resource identifier.  So when client checks the downloaded policies from Ranger it is looking for the user identity being authorized and if client is aware of the group(s) that user belongs to, will also check authorization for that group identity.

 

so in your case, it i s most likely that your client service/application has not been configured with the same user and group association setup in your Ranger service.

 

If you found that the provided solution(s) assisted you with your query, please take a moment to login and click Accept as Solution below each response that helped.

Thank you,

Matt

Translate
Terms & ConditionsAccessibility statement