Adding a Ranger Access Permission Policy for HBase

Scenarios

HBase typically stores large volumes of structured business data. Different business teams and roles have varying access requirements for HBase tables, column families, and columns. The native permission control mechanism in HBase is decentralized and lacks granular control. Configuring permissions using native commands is complex and error-prone, making centralized management and auditing difficult to implement and posing data security risks. To address this, Ranger administrators can use Ranger to configure permissions on HBase tables, column families, and columns for HBase users. This scenario applies to Ranger administrators and Hadoop cluster security O&M personnel. It is used to grant, adjust, and revoke HBase user permissions to ensure data access security and business compliance.

Prerequisites

• The Ranger service has been installed and is running properly in the cluster.
• The users, user groups, or roles requiring permissions must already be created in the cluster. For newly created users, you can configure permission policies only after the users are automatically synchronized to Ranger.

Procedure

1. Log in to the Ranger web UI as the Ranger administrator. For details, see Logging In to the Ranger Web UI.
2. On the home page, click the component plug-in name in the HBASE area, for example, HBase.
3. Click Add New Policy to add an HBase permission control policy.
4. Configure the parameters listed in the table below based on the service demands.

   Table 1 HBase permission parameters

   Parameter	Description
   Policy Name	Policy name, which can be customized and must be unique in the service.
   Policy Conditions	IP address filtering policy, which can be customized. You can enter one or more IP addresses or IP address segments. An IP address can contain the wildcard character (*), for example, 192.168.1.10,192.168.1.20 or 192.168.1.*.
   Policy Label	A label specified for the current policy. You can search for reports and filter policies based on labels.
   HBase Table	Name of the HBase table to which the policy applies. The value can contain wildcard (*). For example, table1:* indicates all tables in table1. The Include policy applies to the current input object, and the Exclude policy applies to objects other than the current input object. The value of hbase.rpc.protection for the HBase service plug-in in Ranger must be the same as that on the HBase server. For details, see Existing HBase Tables Cannot Be Searched Using Wildcards When HBase Permission Policies Are Configured.
   HBase Column-family	Name of the HBase column family to which the policy applies. The Include policy applies to the current input object, and the Exclude policy applies to objects other than the current input object.
   HBase Column	Name of the HBase column to which the policy applies. The Include policy applies to the current input object, and the Exclude policy applies to objects other than the current input object.
   Description	Policy description.
   Audit Logging	Whether to generate an audit log when a request matches the policy. Yes: An audit log is generated whenever an access request matches the policy, regardless of whether the result is Allow or Deny. No: No audit log is generated when an access request matches the policy.
   Allow Conditions	Policy allow conditions, which define the permissions and exceptions authorized by this policy. In the Select Role, Select Group, and Select User columns, select the role, user group, or user to which the permission is to be granted, click Add Conditions, add the IP address range to which the policy applies, and click Add Permissions to add the corresponding permission. Read: permission to read data Write: permission to write data Create: permission to create data Admin: permission to manage data Select/Deselect All: permission to select or deselect all If users or user groups in the current condition need to manage this policy, select Delegate Admin. These users or user groups will become the agent administrators. The agent administrators can update and delete this policy and create sub-policies based on the original policy. To add multiple permission control rules, click . To delete a permission control rule, click . Exclude from Allow Conditions: policy exception conditions
   Deny All Other Accesses	Whether to reject all other access requests. True: All other access requests are rejected. False: Deny Conditions can be configured.
   Deny Conditions	Policy deny conditions, which define the permissions and exceptions that must be rejected by the policy. The configuration method is identical to that of Allow Conditions. The priority of Deny Conditions is higher than that of allowed conditions configured in Allow Conditions. Exclude from Deny Conditions: exception rules excluded from the denied conditions

   Table 2 Common permission configuration scenarios

   Task	Role Authorization
   Setting the HBase administrator permission	On the home page, click the component plug-in name in the HBase area, for example, HBase. Select the policy whose Policy Name is all - table, column-family, column and click to edit the policy. In the Allow Conditions area, select a user from the Select User drop-down list.
   Setting the permission for users to create tables	In HBase Table, specify a table name. In the Allow Conditions area, select a user from the Select User drop-down list. Click Add Permissions and select Create. This user has the following permissions: create table drop table truncate table alter table enable table flush table flush region compact disable enable desc
   Setting the permission for users to write data to tables	In HBase Table, specify a table name. In the Allow Conditions area, select a user from the Select User drop-down list. Click Add Permissions and select Write. The user has permissions for put, delete, append, and incr operations.
   Setting the permission for users to read data from tables	In HBase Table, specify a table name. In the Allow Conditions area, select a user from the Select User drop-down list. Click Add Permissions and select Read. The user has permissions for get and scan operations.
   Setting the permission for users to manage namespaces or tables	In HBase Table, specify a table name. In the Allow Conditions area, select a user from the Select User drop-down list. Click Add Permissions and select Admin. The user has permissions for rsgroup, peer, assign, and balance operations.
   Setting the permission for reading data from or writing data to columns	In HBase Table, specify a table name. In HBase Column-family, specify the column family name. In the Allow Conditions area, select a user from the Select User drop-down list. Click Add Permissions and select Read and Write.

   

   If a user needs to perform the desc operation in hbase shell, the user must be granted the read permission on the hbase:quota table.

5. (Optional) Configure the policy validity period. Click Add Validity period in the upper right corner of the page, set Start Time and End Time, and select Time Zone. Click Save. To add multiple policy validity periods, click . To delete a policy validity period, click .
6. Click Add to view basic information about the policy in the policy list. After the policy takes effect, check whether the related permissions are normal.

   To disable a policy, click and set the policy to Disabled.

   If a policy is no longer used, click to delete it.

Helpful Links

• For details about the priorities of different Ranger policies, see Condition Priorities of the Ranger Permission Policy.
• To view information about permission objects in Ranger, such as users, user groups, and roles, see Viewing Ranger User Permission Synchronization Information.
• You can create new users for an MRS cluster in MRS Manager. For details, see Creating an MRS Cluster User.