Support Questions

Find answers, ask questions, and share your expertise
Announcements
Celebrating as our community reaches 100,000 members! Thank you!

What Ranger based authorization do I need to be able to grant privileges to others through grant command?

avatar
Rising Star

As an example: I have a Hive policy granting 'user1' 'select' privilege on 'default,*,*' with delegate admin set to true. Can 'user1' now issue a grant command to give 'user2', 'create', 'update' and 'select' privileges on 'default,*,*' ? user1 itself does not have the privileges its granting to user2 on the resources. @vperiasamy

1 ACCEPTED SOLUTION

avatar
Master Guru

I've just tried the scenario you described on HDP-2.5.3 (Ranger-0.6) and it works, my user1 has only "Select" privilege but could grant all privileges to user2, and he can even grant "all" to himself. I think the idea with "Delegate Admin" is that you can set certain user to be a Ranger admin on given resources. Though, I've never seen this well documented. And actually the User guide for Ranger-0.5 says that The delegated admin can update, delete the policies. It can also create child policies based on the original policy (base policy). So, if you want to avoid unexpected surprises you can disable "Delegate Admin" in all policies, and control everything by the central admin.

View solution in original post

2 REPLIES 2

avatar

In the above situation, I believe 'user1' will be able to grant to 'user2' any permissions, because delegate admin access is for the resources specified, not for the specific permissions.

@sneethiraj can offer more insights.

avatar
Master Guru

I've just tried the scenario you described on HDP-2.5.3 (Ranger-0.6) and it works, my user1 has only "Select" privilege but could grant all privileges to user2, and he can even grant "all" to himself. I think the idea with "Delegate Admin" is that you can set certain user to be a Ranger admin on given resources. Though, I've never seen this well documented. And actually the User guide for Ranger-0.5 says that The delegated admin can update, delete the policies. It can also create child policies based on the original policy (base policy). So, if you want to avoid unexpected surprises you can disable "Delegate Admin" in all policies, and control everything by the central admin.