Support Questions
Find answers, ask questions, and share your expertise
Announcements
Alert: Welcome to the Unified Cloudera Community. Former HCC members be sure to read and learn how to activate your account here.

What Ranger based authorization do I need to be able to grant privileges to others through grant command?

Solved Go to solution
Highlighted

What Ranger based authorization do I need to be able to grant privileges to others through grant command?

Contributor

As an example: I have a Hive policy granting 'user1' 'select' privilege on 'default,*,*' with delegate admin set to true. Can 'user1' now issue a grant command to give 'user2', 'create', 'update' and 'select' privileges on 'default,*,*' ? user1 itself does not have the privileges its granting to user2 on the resources. @vperiasamy

1 ACCEPTED SOLUTION

Accepted Solutions

Re: What Ranger based authorization do I need to be able to grant privileges to others through grant command?

I've just tried the scenario you described on HDP-2.5.3 (Ranger-0.6) and it works, my user1 has only "Select" privilege but could grant all privileges to user2, and he can even grant "all" to himself. I think the idea with "Delegate Admin" is that you can set certain user to be a Ranger admin on given resources. Though, I've never seen this well documented. And actually the User guide for Ranger-0.5 says that The delegated admin can update, delete the policies. It can also create child policies based on the original policy (base policy). So, if you want to avoid unexpected surprises you can disable "Delegate Admin" in all policies, and control everything by the central admin.

2 REPLIES 2

Re: What Ranger based authorization do I need to be able to grant privileges to others through grant command?

In the above situation, I believe 'user1' will be able to grant to 'user2' any permissions, because delegate admin access is for the resources specified, not for the specific permissions.

@sneethiraj can offer more insights.

Re: What Ranger based authorization do I need to be able to grant privileges to others through grant command?

I've just tried the scenario you described on HDP-2.5.3 (Ranger-0.6) and it works, my user1 has only "Select" privilege but could grant all privileges to user2, and he can even grant "all" to himself. I think the idea with "Delegate Admin" is that you can set certain user to be a Ranger admin on given resources. Though, I've never seen this well documented. And actually the User guide for Ranger-0.5 says that The delegated admin can update, delete the policies. It can also create child policies based on the original policy (base policy). So, if you want to avoid unexpected surprises you can disable "Delegate Admin" in all policies, and control everything by the central admin.