Ranger Permissions | Hive table acess based on Partition Directory

Question

I was looking for help on following usecase to be implemted by Ranger Authorization service in HDP.

I have a hive table 'customer' which holds below two partitions loaded from HDFS.

/data/mydatabase/customer/partition1/

/data/mydatabase/customer/SenstivePartition2/

I have two user - user1 and user2 and I want to define a policy in such a way that

user1 --> should be able to access --> partition1

user2 --> should be able to access --> partition1 and SenstivePartition2 both.

As Second partition is highly sensitive therefore I do not want to define table level policy otherwise both user will get all access.

Thanks Shashi

Answer 1

I don't think you can set authorization based on partitions based on this forum info. You can set up a partitioned materialized view in HDP 3.0.1 and later as described in these docs and then set up the Ranger authorization on the views as tables.

Answer 2

It is not exactly what you asked, but what may help you is the even more fine-grained row level access control.

Here is documented how you can set up row-level filtering in ranger for hive tables: https://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.6.5/bk_security/content/ranger_row_level_filtering_in_hive.html