Apache Ranger for authorization in Hadoop - Step-by-Step Execution

Concept Flow - Apache Ranger for authorization

User Request Access

↓

Apache Ranger Receives Request

↓

Check Policies in Ranger Admin

↓

Match User and Resource

↓

Allow or Deny Access

↓

Return Decision to Hadoop Service

↓

Grant or Block User Action

Apache Ranger intercepts user requests, checks policies, and decides if access is allowed or denied.

Execution Sample

Hadoop

# Pseudo-code for Ranger authorization check
user = 'alice'
resource = '/data/sales'
policy = ranger.get_policy(user, resource)
if policy.allows('read'):
    print('Access granted')
else:
    print('Access denied')

This code simulates how Ranger checks if user 'alice' can read the sales data.

Execution Table

Step	Action	Input	Policy Check Result	Decision
1	Receive user request	User=alice, Resource=/data/sales	N/A	Pending
2	Fetch policy for user and resource	User=alice, Resource=/data/sales	Policy found: read allowed	Pending
3	Check if 'read' permission allowed	Permission=read	Allowed	Access granted
4	Return decision to Hadoop service	Decision=Access granted	N/A	User allowed to read data

💡 Access granted because policy allows 'read' permission for user 'alice' on resource '/data/sales'.

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	Final
user	None	alice	alice	alice	alice
resource	None	/data/sales	/data/sales	/data/sales	/data/sales
policy	None	None	read allowed	read allowed	read allowed
decision	None	Pending	Pending	Access granted	Access granted

Key Moments - 2 Insights

Why does Ranger check policies before allowing access?

Ranger must verify user permissions against policies to ensure only authorized actions are allowed, as shown in execution_table step 2 and 3.

What happens if no policy matches the user and resource?

If no policy matches, Ranger denies access by default to keep data safe, which would be reflected in a 'Policy not found' and 'Access denied' decision.

Visual Quiz - 3 Questions

Look at the execution table, what is the policy check result at step 2?

A Policy not found

B Policy found: read allowed

C Access denied

D Permission denied

💡 Hint

Check the 'Policy Check Result' column in row for step 2.

At which step does Ranger decide to grant access?

A Step 1

B Step 4

C Step 3

D Step 2

💡 Hint

Look at the 'Decision' column to find when 'Access granted' appears.

If the policy did not allow 'read', what would be the decision at step 3?

A Access denied

B Access pending

C Access granted

D Policy found

💡 Hint

Refer to the logic in execution_table step 3 where permission check determines decision.

Concept Snapshot

Apache Ranger controls access by checking user requests against policies.
It intercepts requests, matches user and resource to policies,
and allows or denies actions based on permissions.
Default is deny if no matching policy.
Used to secure Hadoop data access centrally.

Full Transcript

Apache Ranger is a tool that helps control who can do what with data in Hadoop. When a user tries to access data, Ranger checks its policies to see if the user has permission. If the policy allows the action, Ranger grants access; otherwise, it denies it. This process protects data by making sure only authorized users can read or modify it. The example shows a user named alice trying to read sales data. Ranger finds a policy that allows this, so access is granted. If no policy matched, access would be denied by default.