Configuring Resource Permissions

Prerequisites

• A Ranger connection has been created in Management Center, and a correct RangerAdmin service IP address and Ranger service port have been set for the connection (see Configuring an MRS Ranger Connection for details).
  

  When you test the Ranger connection in Management Center, the Ranger service IP address and port will not be verified, and no error will be reported even if they are incorrect. You are advised to check them manually.

• Ranger authentication has been enabled for the corresponding MRS cluster. In security mode, Ranger authentication is enabled by default. In common mode, Ranger authentication is disabled by default. For details, see Enabling Ranger Authentication.

Constraints

• Resource permission policies depend on the Ranger authentication of MRS clusters. Currently, only permissions on MRS resources can be controlled.
• A permission policy takes effect about 1 minute after being configured.

MRS Components that Support Access Control and the Permission List

Ranger can be used to integrate components in MRS clusters of version 3.0.0 or a later version to enable fine-grained access permission control for components. Table 1 lists the supported components and describes related permissions. For details, see Configuring Component Permission Policies.

Creating an HDFS Permission Policy

1. On the DataArts Studio console, locate an instance and click Access. On the displayed page, locate a workspace and click DataArts Security.
   Figure 1 DataArts Security
   

2. Choose Access Permission Management > Resource Permission Settings from the left navigation bar.
   

   If error message "cluster [mrs_3x_autotest_do_not_del] get service failed. due to [null response from cdm:[404 NOT FOUND]]." is displayed, check whether the RangerAdmin service IP address and Ranger service port of the Ranger connection are correct in Management Center by referring to Configuring an MRS Ranger Connection.

   Figure 2 Resource Permission Settings page
   

3. Click Configure to the right of hacluster under the HDFS component, and click Create in the upper part of the page displayed.
   Figure 3 Creating a permission policy
   

4. Set the parameters and click OK.
   Figure 4 Assigning a permission policy
   

   Table 2 Parameters for configuring an HDFS permission policy

   Parameter	Description
   Policy Type	The policy type is automatically generated based on the selected service component. Policy Type can be set to Access, Mask, and Row-level Filter. Mask and Row-level Filter are specific to Hive.
   Policy Status	If Policy Status is Enabled, the permission policy takes effect immediately. If Policy Status is Disabled, the permission policy does not take effect after being created. Policy Status is set to Enabled by default.
   Overwrite	If Overwrite is set to Enabled, the new policy takes effect and the old policy does not take effect. Overwrite is set to Enabled by default. When you need to create a temporary access policy, enable Overwrite and set Validity Period as required. In this way, even if the temporary access policy expires, the original permission policy still takes effect.
   Audit Log	If Audit Log is set to Enabled, logs are recorded. The log content includes the client access time, client IP address, client user, and resource operation result.
   Policy Name	Policy name is mandatory. A policy name can include only letters, numbers, underscores (_), and hyphens (-). Up to 50 characters are allowed.
   Description	A description of the policy. Up to 256 characters are allowed.
   Topology	HDFS path for access permission control.
   Recursion	If the function is enabled, the resource path is in recursive mode. If the function is disabled, the resource path is in non-recursive mode. Policy Status is set to Enabled by default.
   Validity Period	You can set the effective time and expiration time of a policy. You can configure multiple time ranges.
   Allowed	Users and user groups that are allowed to access the resources. Username: MRS user. Role: MRS role. Group: MRS user groups. Permission: the permission required by users who are allowed to access the system. Permission and Username can be left blank or not left blank at the same time. For details on service permissions, see Table 1. Granted: If Granted is selected, management permissions are assigned to appropriate users and groups. Delegated administrators can update and delete policies and create sub-policies based on the original policies.
   Exceptions	If you select Exceptions for Allowed, users who are not allowed to access the system are added to the user group that is allowed to access the system. If you select Exceptions for blocked, users who are allowed to access the system are added to the user group that is blocked from the system.
   Block all other accesses	If you select Block all other accesses, only specified users or user groups are allowed to access the system.
   Blocked	Blocked is displayed when Block all other accesses is not selected. Users and user groups that are not allowed to access the system can be specified in the Blocked area. Username: MRS user. Role: MRS role. Group: MRS user groups. Permission: the permission required by users who are not allowed to access the system. Permission and Username can be left blank or not left blank at the same time. For details on service permissions, see Table 1. Granted: If Granted is selected, management permissions are assigned to appropriate users and groups. Delegated administrators can update and delete policies and create sub-policies based on the original policies.

Creating a Hive Access Permission Policy

1. On the DataArts Studio console, locate an instance and click Access. On the displayed page, locate a workspace and click DataArts Security.
   Figure 5 DataArts Security
   

2. Choose Access Permission Management > Resource Permission Settings from the left navigation bar.
   

   If error message "cluster [mrs_3x_autotest_do_not_del] get service failed. due to [null response from cdm:[404 NOT FOUND]]." is displayed, check whether the RangerAdmin service IP address and Ranger service port of the Ranger connection are correct in Management Center by referring to Configuring an MRS Ranger Connection.

   Figure 6 Resource Permission Settings page
   

3. Click Configure to the right of the Hive component, and click Create in the upper part of the page displayed.
   Figure 7 Creating a permission policy
   

4. Set the parameters and click OK.
   Figure 8 Configuring a Hive policy
   
   The following table lists the parameters of a Hive permission policy.

   Table 3 Parameters of a Hive permission policy

   Parameter	Description
   Policy Type	The policy type is automatically generated based on the selected service component. Policy Type can be set to Access, Mask, and Row-level Filter. Mask and Row-level Filter are specific to Hive.
   Policy Status	If Policy Status is Enabled, the permission policy takes effect immediately. If Policy Status is Disabled, the permission policy does not take effect after being created. Policy Status is set to Enabled by default.
   Overwrite	If Overwrite is set to Enabled, the new policy takes effect and the old policy does not take effect. Overwrite is set to Enabled by default. To create a temporary access policy, enable Overwrite and set Validity Period as required. In this way, even if the temporary access policy expires, the original permission policy still takes effect.
   Audit Log	If Audit Log is set to Enabled, logs are recorded. The log content includes the client access time, client IP address, client user, and resource operation result.
   Policy Name	Policy name is mandatory. A policy name can include only letters, numbers, underscores (_), and hyphens (-). Up to 50 characters are allowed.
   Description	A description of the policy. Up to 256 characters are allowed.
   database	The database parameter is mandatory. You can set the database whose permissions need to be controlled. Fuzzy search is supported.
   table	The table parameter is mandatory. You can set the table whose permissions need to be controlled. Fuzzy search is supported.
   Column	The Column parameter is mandatory. You can set the column whose permissions need to be controlled. Fuzzy search is supported.
   Validity Period	You can set the effective time and expiration time of a policy. You can configure multiple time ranges.
   Allowed	Users and user groups that are allowed to access the resources. Username: MRS user. Role: MRS role. Group: MRS user groups. Permission: the permission required by users who are allowed to access the system. Permission and Username can be left blank or not left blank at the same time. For details on service permissions, see Table 1. Granted: If Granted is selected, management permissions are assigned to appropriate users and groups. Delegated administrators can update and delete policies and create sub-policies based on the original policies.
   Exceptions	If you select Exceptions for Allowed, users who are not allowed to access the system are added to the user group that is allowed to access the system. If you select Exceptions for blocked, users who are allowed to access the system are added to the user group that is blocked from the system.
   Block all other accesses	If you select Block all other accesses, only specified users or user groups are allowed to access the system.
   Blocked	Blocked is displayed when Block all other accesses is not selected. Users and user groups that are not allowed to access the system can be specified in the Blocked area. Username: MRS user. Role: MRS role. Group: MRS user groups. Permission: the permission required by users who are not allowed to access the system. Permission and Username can be left blank or not left blank at the same time. For details on service permissions, see Table 1. Granted: If Granted is selected, management permissions are assigned to appropriate users and groups. Delegated administrators can update and delete policies and create sub-policies based on the original policies.

Creating a Hive Masking Permission Policy

1. On the DataArts Studio console, locate an instance and click Access. On the displayed page, locate a workspace and click DataArts Security.
   Figure 9 DataArts Security
   

2. Choose Access Permission Management > Resource Permission Settings from the left navigation bar.
   

   If error message "cluster [mrs_3x_autotest_do_not_del] get service failed. due to [null response from cdm:[404 NOT FOUND]]." is displayed, check whether the RangerAdmin service IP address and Ranger service port of the Ranger connection are correct in Management Center by referring to Configuring an MRS Ranger Connection.

   Figure 10 Resource Permission Settings page
   

3. Click Configure to the right of the Hive component, and click Create in the upper part of the Mask tab page.
   Figure 11 Creating a permission policy
   

4. Set the parameters and click OK.
   Figure 12 Configuring a Hive policy
   

   Table 4 Parameters of a Hive permission policy

   Parameter	Description
   Policy Type	The policy type is automatically generated based on the selected service component. Policy Type can be set to Access, Mask, and Row-level Filter. Mask and Row-level Filter are specific to Hive.
   Policy Status	If Policy Status is Enabled, the permission policy takes effect immediately. If Policy Status is Disabled, the permission policy does not take effect after being created. Policy Status is set to Enabled by default.
   Overwrite	If Overwrite is set to Enabled, the new policy takes effect and the old policy does not take effect. Overwrite is set to Enabled by default. To create a temporary access policy, enable Overwrite and set Validity Period as required. In this way, even if the temporary access policy expires, the original permission policy still takes effect.
   Audit Log	If Audit Log is set to Enabled, logs are recorded. The log content includes the client access time, client IP address, client user, and resource operation result.
   Policy Name	Policy name is mandatory. A policy name can include only letters, numbers, underscores (_), and hyphens (-). Up to 50 characters are allowed.
   Description	A description of the policy. Up to 256 characters are allowed.
   Database	The Database parameter is mandatory. You can set the database whose permissions need to be controlled. Fuzzy search is supported.
   Data Table	The Data Table parameter is mandatory. You can set the table whose permissions need to be controlled. Fuzzy search is supported.
   Column	The Column parameter is mandatory. You can set the column whose permissions need to be controlled. Fuzzy search is supported.
   Validity Period	You can set the effective time and expiration time of a policy. You can configure multiple time ranges.
   Mask	The masking mode for users or user groups to access data. Username: MRS user. Role: MRS role. Group: MRS user groups. Permission: the permission required by users who are allowed to access the system. Permission and Username can be left blank or not left blank at the same time. For details on service permissions, see Table 1. Mask Mode: Columns that require permission control in a Hive table are masked based on the value of this parameter.

Creating a Hive Row-Level Filter Permission Policy

1. On the DataArts Studio console, locate an instance and click Access. On the displayed page, locate a workspace and click DataArts Security.
   Figure 13 DataArts Security
   

2. Choose Access Permission Management > Resource Permission Settings from the left navigation bar.
   

   If error message "cluster [mrs_3x_autotest_do_not_del] get service failed. due to [null response from cdm:[404 NOT FOUND]]." is displayed, check whether the RangerAdmin service IP address and Ranger service port of the Ranger connection are correct in Management Center by referring to Configuring an MRS Ranger Connection.

   Figure 14 Resource Permission Settings page
   

3. Click Configure to the right of the Hive component, and click Create in the upper part of the Row-level Filter tab page.
   Figure 15 Creating a Hive row-level filter policy
   

4. Set the parameters and click OK.
   Figure 16 Configuring a Hive policy
   

   Table 5 Parameters of a Hive permission policy

   Parameter	Description
   Policy Type	The policy type is automatically generated based on the selected service component. Policy Type can be set to Access, Mask, and Row-level Filter. Mask and Row-level Filter are specific to Hive.
   Policy Status	If Policy Status is Enabled, the permission policy takes effect immediately. If Policy Status is Disabled, the permission policy does not take effect after being created. Policy Status is set to Enabled by default.
   Overwrite	If Overwrite is set to Enabled, the new policy takes effect and the old policy does not take effect. Overwrite is set to Enabled by default. To create a temporary access policy, enable Overwrite and set Validity Period as required. In this way, even if the temporary access policy expires, the original permission policy still takes effect.
   Audit Log	If Audit Log is set to Enabled, logs are recorded. The log content includes the client access time, client IP address, client user, and resource operation result.
   Policy Name	Policy name is mandatory. A policy name can include only letters, numbers, underscores (_), and hyphens (-). Up to 50 characters are allowed.
   Description	A description of the policy. Up to 256 characters are allowed.
   Database	The Database parameter is mandatory. You can set the database whose permissions need to be controlled. Fuzzy search is supported.
   Data Table	The Data Table parameter is mandatory. You can set the table whose permissions need to be controlled. Fuzzy search is supported.
   Column	The Column parameter is mandatory. You can set the column whose permissions need to be controlled. Fuzzy search is supported.
   Validity Period	You can set the effective time and expiration time of a policy. You can configure multiple time ranges.
   Row-level Filter	Users and user groups that are allowed to access the resources. Username: MRS user. Role: MRS role. Group: MRS user groups. Permission: the permission required by users who are allowed to access the system. Permission and Username can be left blank or not left blank at the same time. For details on service permissions, see Table 1. Row-level Filter: Filter by field content. The parameter format is as follows: Field=Value. Example: state=1.

Creating an HBase Permission Policy

1. On the DataArts Studio console, locate an instance and click Access. On the displayed page, locate a workspace and click DataArts Security.
   Figure 17 DataArts Security
   

2. Choose Access Permission Management > Resource Permission Settings from the left navigation bar.
   

   If error message "cluster [mrs_3x_autotest_do_not_del] get service failed. due to [null response from cdm:[404 NOT FOUND]]." is displayed, check whether the RangerAdmin service IP address and Ranger service port of the Ranger connection are correct in Management Center by referring to Configuring an MRS Ranger Connection.

   Figure 18 Resource Permission Settings page
   

3. Click Configure to the right of the HBase component, and click Create in the upper part of the page displayed.
   Figure 19 Creating an HBase permission policy
   

4. Set the parameters and click OK.
   Figure 20 Configuring an HBase policy
   

   Table 6 Parameters of an HBase permission policy

   Parameter	Description
   Policy Type	The policy type is automatically generated based on the selected service component. Policy Type can be set to Access, Mask, and Row-level Filter. Mask and Row-level Filter are specific to Hive.
   Policy Status	If Policy Status is Enabled, the permission policy takes effect immediately. If Policy Status is Disabled, the permission policy does not take effect after being created. Policy Status is set to Enabled by default.
   Overwrite	If Overwrite is set to Enabled, the new policy takes effect and the old policy does not take effect. Overwrite is set to Enabled by default. To create a temporary access policy, enable Overwrite and set Validity Period as required. In this way, even if the temporary access policy expires, the original permission policy still takes effect.
   Audit Log	If Audit Log is set to Enabled, logs are recorded. The log content includes the client access time, client IP address, client user, and resource operation result.
   Policy Name	Policy name is mandatory. A policy name can include only letters, numbers, underscores (_), and hyphens (-). Up to 50 characters are allowed.
   Description	A description of the policy. Up to 256 characters are allowed.
   Data Table	The Data Table parameter is mandatory. You can set the table whose permissions need to be controlled. Fuzzy search is supported.
   Column	The Column parameter is mandatory. You can set the column whose permissions need to be controlled. Fuzzy search is supported.
   Column Family	Column Family is mandatory. This parameter indicates a set of column families in an HBase cluster.
   Validity Period	You can set the effective time and expiration time of a policy. You can configure multiple time ranges.
   Allowed	Users and user groups that are allowed to access the resources. Username: MRS user. Role: MRS role. Group: MRS user groups. Permission: the permission required by users who are allowed to access the system. Permission and Username can be left blank or not left blank at the same time. For details on service permissions, see Table 1. Granted: If Granted is selected, management permissions are assigned to appropriate users and groups. Delegated administrators can update and delete policies and create sub-policies based on the original policies.
   Exceptions	If you select Exceptions for Allowed, users who are not allowed to access the system are added to the user group that is allowed to access the system. If you select Exceptions for blocked, users who are allowed to access the system are added to the user group that is blocked from the system.
   Block all other accesses	If you select Block all other accesses, only specified users or user groups are allowed to access the system.
   Blocked	Blocked is displayed when Block all other accesses is not selected. Users and user groups that are not allowed to access the system can be specified in the Blocked area. Username: MRS user. Role: MRS role. Group: MRS user groups. Permission: the permission required by users who are not allowed to access the system. Permission and Username can be left blank or not left blank at the same time. For details on service permissions, see Table 1. Granted: If Granted is selected, management permissions are assigned to appropriate users and groups. Delegated administrators can update and delete policies and create sub-policies based on the original policies.

Creating a Yarn Permission Policy

1. On the DataArts Studio console, locate an instance and click Access. On the displayed page, locate a workspace and click DataArts Security.
   Figure 21 DataArts Security
   

2. Choose Access Permission Management > Resource Permission Settings from the left navigation bar.
   

   If error message "cluster [mrs_3x_autotest_do_not_del] get service failed. due to [null response from cdm:[404 NOT FOUND]]." is displayed, check whether the RangerAdmin service IP address and Ranger service port of the Ranger connection are correct in Management Center by referring to Configuring an MRS Ranger Connection.

   Figure 22 Resource Permission Settings page
   

3. Click Configure to the right of the Yarn component, and click Create in the upper part of the page that is displayed.
   Figure 23 Creating a Yarn permission policy
   

4. Set the parameters and click OK.
   Figure 24 Configuring a Yarn policy
   

   Table 7 Parameters of a Yarn permission policy

   Parameter	Description
   Policy Type	The policy type is automatically generated based on the selected service component. Policy Type can be set to Access, Mask, and Row-level Filter. Mask and Row-level Filter are specific to Hive.
   Policy Status	If Policy Status is Enabled, the permission policy takes effect immediately. If Policy Status is Disabled, the permission policy does not take effect after being created. Policy Status is set to Enabled by default.
   Overwrite	If Overwrite is set to Enabled, the new policy takes effect and the old policy does not take effect. Overwrite is set to Enabled by default. To create a temporary access policy, enable Overwrite and set Validity Period as required. In this way, even if the temporary access policy expires, the original permission policy still takes effect.
   Audit Log	If Audit Log is set to Enabled, logs are recorded. The log content includes the client access time, client IP address, client user, and resource operation result.
   Policy Name	Policy name is mandatory. A policy name can include only letters, numbers, underscores (_), and hyphens (-). Up to 50 characters are allowed.
   Description	A description of the policy. Up to 256 characters are allowed.
   Queue	Resource scheduling queue in the Yarn service.
   Validity Period	You can set the effective time and expiration time of a policy. You can configure multiple time ranges.
   Allowed	Users and user groups that are allowed to access the resources. Username: MRS user. Role: MRS role. Group: MRS user groups. Permission: the permission required by users who are allowed to access the system. Permission and Username can be left blank or not left blank at the same time. For details on service permissions, see Table 1. Granted: If Granted is selected, management permissions are assigned to appropriate users and groups. Delegated administrators can update and delete policies and create sub-policies based on the original policies.
   Exceptions	If you select Exceptions for Allowed, users who are not allowed to access the system are added to the user group that is allowed to access the system. If you select Exceptions for blocked, users who are allowed to access the system are added to the user group that is blocked from the system.
   Block all other accesses	If you select Block all other accesses, only specified users or user groups are allowed to access the system.
   Blocked	Blocked is displayed when Block all other accesses is not selected. Users and user groups that are not allowed to access the system can be specified in the Blocked area. Username: MRS user. Role: MRS role. Group: MRS user groups. Permission: the permission required by users who are not allowed to access the system. Permission and Username can be left blank or not left blank at the same time. For details on service permissions, see Table 1. Granted: If Granted is selected, management permissions are assigned to appropriate users and groups. Delegated administrators can update and delete policies and create sub-policies based on the original policies.

Creating a Kafka Permission Policy

1. On the DataArts Studio console, locate an instance and click Access. On the displayed page, locate a workspace and click DataArts Security.
   Figure 25 DataArts Security
   

2. Choose Access Permission Management > Resource Permission Settings from the left navigation bar.
   

   If error message "cluster [mrs_3x_autotest_do_not_del] get service failed. due to [null response from cdm:[404 NOT FOUND]]." is displayed, check whether the RangerAdmin service IP address and Ranger service port of the Ranger connection are correct in Management Center by referring to Configuring an MRS Ranger Connection.

   Figure 26 Resource Permission Settings page
   

3. Click Configure to the right of the Kafka component, and click Create in the upper part of the page that is displayed.
   Figure 27 Creating a Kafka permission policy
   

4. Set the parameters and click OK.
   Figure 28 Configuring a Kafka policy
   

   Table 8 Parameters of a Kafka permission policy

   Parameter	Description
   Policy Type	The policy type is automatically generated based on the selected service component. Policy Type can be set to Access, Mask, and Row-level Filter. Mask and Row-level Filter are specific to Hive.
   Policy Status	If Policy Status is Enabled, the permission policy takes effect immediately. If Policy Status is Disabled, the permission policy does not take effect after being created. Policy Status is set to Enabled by default.
   Overwrite	If Overwrite is set to Enabled, the new policy takes effect and the old policy does not take effect. Overwrite is set to Enabled by default. To create a temporary access policy, enable Overwrite and set Validity Period as required. In this way, even if the temporary access policy expires, the original permission policy still takes effect.
   Audit Log	If Audit Log is set to Enabled, logs are recorded. The log content includes the client access time, client IP address, client user, and resource operation result.
   Policy Name	Policy name is mandatory. A policy name can include only letters, numbers, underscores (_), and hyphens (-). Up to 50 characters are allowed.
   Description	A description of the policy. Up to 256 characters are allowed.
   Policy Conditions	Range of IP addresses that can access the Kafka topic.
   Topic	The message topic of a Kafka cluster.
   Validity Period	You can set the effective time and expiration time of a policy. You can configure multiple time ranges.
   Allowed	Users and user groups that are allowed to access the resources. Username: MRS user. Role: MRS role. Group: MRS user groups. Permission: the permission required by users who are allowed to access the system. Permission and Username can be left blank or not left blank at the same time. For details on service permissions, see Table 1. Policy Conditions: the range of IP addresses that can access the Kafka topic. Granted: If Granted is selected, management permissions are assigned to appropriate users and groups. Delegated administrators can update and delete policies and create sub-policies based on the original policies.
   Exceptions	If you select Exceptions for Allowed, users who are not allowed to access the system are added to the user group that is allowed to access the system. If you select Exceptions for blocked, users who are allowed to access the system are added to the user group that is blocked from the system.
   Blocked	Blocked is displayed when Block all other accesses is not selected. Users and user groups that are not allowed to access the system can be specified in the Blocked area. Username: MRS user. Role: MRS role. Group: MRS user groups. Permission: the permission required by users who are not allowed to access the system. Permission and Username can be left blank or not left blank at the same time. For details on service permissions, see Table 1. Policy Conditions: the range of IP addresses that can access the Kafka topic. Granted: If Granted is selected, management permissions are assigned to appropriate users and groups. Delegated administrators can update and delete policies and create sub-policies based on the original policies.

Creating a Storm Permission Policy

1. On the DataArts Studio console, locate an instance and click Access. On the displayed page, locate a workspace and click DataArts Security.
   Figure 29 DataArts Security
   

2. Choose Access Permission Management > Resource Permission Settings from the left navigation bar.
   

   If error message "cluster [mrs_3x_autotest_do_not_del] get service failed. due to [null response from cdm:[404 NOT FOUND]]." is displayed, check whether the RangerAdmin service IP address and Ranger service port of the Ranger connection are correct in Management Center by referring to Configuring an MRS Ranger Connection.

   Figure 30 Resource Permission Settings page
   

3. Click Configure to the right of the Storm component, and click Create in the upper part of the page displayed.
   Figure 31 Creating a Storm permission policy
   

4. Set the parameters and click OK.
   Figure 32 Configuring a Storm policy
   

   Table 9 Parameters of a Storm permission policy

   Parameter	Description
   Policy Type	The policy type is automatically generated based on the selected service component. Policy Type can be set to Access, Mask, and Row-level Filter. Mask and Row-level Filter are specific to Hive.
   Policy Status	If Policy Status is Enabled, the permission policy takes effect immediately. If Policy Status is Disabled, the permission policy does not take effect after being created. Policy Status is set to Enabled by default.
   Overwrite	If Overwrite is set to Enabled, the new policy takes effect and the old policy does not take effect. Overwrite is set to Enabled by default. To create a temporary access policy, enable Overwrite and set Validity Period as required. In this way, even if the temporary access policy expires, the original permission policy still takes effect.
   Audit Log	If Audit Log is set to Enabled, logs are recorded. The log content includes the client access time, client IP address, client user, and resource operation result.
   Policy Name	Policy name is mandatory. A policy name can include only letters, numbers, underscores (_), and hyphens (-). Up to 50 characters are allowed.
   Description	A description of the policy. Up to 256 characters are allowed.
   Topology	Tasks in a Storm cluster.
   Validity Period	You can set the effective time and expiration time of a policy. You can configure multiple time ranges.
   Allowed	Users and user groups that are allowed to access the resources. Username: MRS user. Role: MRS role. Group: MRS user groups. Permission: the permission required by users who are allowed to access the system. Permission and Username can be left blank or not left blank at the same time. For details on service permissions, see Table 1. Granted: If Granted is selected, management permissions are assigned to appropriate users and groups. Delegated administrators can update and delete policies and create sub-policies based on the original policies.
   Exceptions	If you select Exceptions for Allowed, users who are not allowed to access the system are added to the user group that is allowed to access the system. If you select Exceptions for blocked, users who are allowed to access the system are added to the user group that is blocked from the system.
   Block all other accesses	If you select Block all other accesses, only specified users or user groups are allowed to access the system.
   Blocked	Blocked is displayed when Block all other accesses is not selected. Users and user groups that are not allowed to access the system can be specified in the Blocked area. Username: MRS user. Role: MRS role. Group: MRS user groups. Permission: the permission required by users who are not allowed to access the system. Permission and Username can be left blank or not left blank at the same time. For details on service permissions, see Table 1. Granted: If Granted is selected, management permissions are assigned to appropriate users and groups. Delegated administrators can update and delete policies and create sub-policies based on the original policies.