@ Manoj Dhake : To be able to create ur own DB/tables as a user say user1, you will first need an access policy in Ranger for user1 with create permission atleast. I am guessing you know this part. Then you need to tag your Hive resources through Atlas UI. For that you would need an Atlas Ranger policy which will give appropriate permissions to the user used for tagging . Once your resources are tagged, you can create a tag based policy in Ranger depending on your need. Like, if you want user2 to be restricted from seeing any table, say table2 tagged with PII (Table level tag), you create a tag policy with Tag=PII, Under DENY CONDITIONS, put user=user2, and for Component Permissions, select Hive and the Hive operations the user should not be able to perform on the table. Then add the tag service name in Hive Service by editing Hive service and using field: 'Select Tag Service'. Now when you try to do any operation on table2 as user2, you will be denied access, even if there is an access policy granting all permissions to user2 on table2. OR IF you want user2 access to ONLY tagged resources like table2, table3 tagged with 'user' tag, then make sure there is no access based policy for user2 or any of its groups and create a tag based policy with tag='user', in Allow conditions, put user='user2', and for Component Permissions, select Hive and the Hive operations the user should be able to perform on resources tagged with 'user' tag. Hope this helps. The above 2 examples are typical usages of tag based policies. Pls vote up if you find the answer useful.
... View more
