Ranger stacked policy evaluation with EXCLUDE switch

[#1]

Hi,

I have read the manual but I don't understand the behaviour of 2 policies I have regarding the same Hive table.

Policy 15 is a global allow policy on all Hive tables, all columns:

then I have policy 31 like this:

But whatever I try, user raj_ops still can run 'select * from employee' and get results.

Policy 31 is not evaluated as a 'deny' on the resource. I know you can add explicit Deny Conditons to the hive service, and I will try that. But the question is what the EXCLUDE switch (after the Hive column* box ) is good for when it is not picked up.

[#2]

you mentioned there is a global allow policy , can you please attach screenshot of that too

[#3]

@Deepak Sharma added in main question

[#4]

@Jasper in policy 15 i can see you have added * resources for all and raj_ops is part of the user , so he is able to access all

[#5]

@Deepak Sharma Yes, but I would expect that if 1 policy (15) says 'yes' and the other (31) says 'no', then it should be 'no' . As is stated in the schema in the manual

[#6]

No @Jasper this will be the case when there is deny condition for raj_ops , then raj_ops will be denied from performing operation, but in current scenario you can see both are allow condition , in such case if any of the condtion match then it will be allowed , and even manual also says same !

[#7]

For the moment I will not use this exclude switch because it behaves not as I (and my client) would expect. I will go for the Deny Conditions extension for the Hive service.

The exclude switch is confusing in that it seems to swap an allow into a deny, but it doesn't. It only excludes the resources from the policy

[#8 · Accepted solution]

For the moment I will not use this exclude switch because it behaves not as I (and my client) would expect. I will go for the Deny Conditions extension for the Hive service.

The exclude switch is confusing in that it seems to swap an allow into a deny, but it doesn't. It only excludes the resources from the policy