Member since
05-05-2024
1
Post
0
Kudos Received
0
Solutions
05-06-2024
12:28 AM
Hi everyone, I've been exploring Ranger for access control with Trino and while doing some tests I found out, that for one of the use cases I need, an user could be in multiple groups. Each of the groups would have a custom row level filter in the same table. Example of row level filters: Select Group = Group_UK, Access Type = Select, Row Level Filter = (country = 'UK') Select Group = Group_DE, Access Type = Select, Row Level Filter = (country = 'DE') If I have a row level policy defined as shown in the example and my user is in both of this groups I will only be able to see the data with the row level filter (country = 'UK'). All other filters coming after the first one won't work for any of the users that are in multiple groups. Is there a way to enable this functionality in Ranger? or can I only give one filter to one user per table? e.g. Select User = user_a, Access Type = Select, Row Level Filter = (country in ('UK', 'DE')) I came up with a workaround to this which is to deduce based on the groups an user is part of the needed filter and create through a script row level filters only for users and update the row level policies with the Rest API in Ranger. Example 1: user_a is in Group_UK and Group_DE Therefore the following filter will be created: Select User = user_a, Access Type = Select, Row Level Filter = (country in ('UK', 'DE')) Example 2: user_b is in Group_UK Therefore the following filter will be created: Select User = user_b, Access Type = Select, Row Level Filter = (country in ('UK')) Regards and thanks in advance.
... View more
Labels:
- Labels:
-
Apache Ranger