- PrivaceraCloud Release 7.4
- Enhancements and updates in PrivaceraCloud release 7.4
- Known Issues in PrivaceraCloud 7.4
- PrivaceraCloud User Guide
- Overview of PrivaceraCloud
- Connect applications with the setup wizard
- Connect applications
- About applications
- Connect Azure Data Lake Storage Gen 2 (ADLS) to PrivaceraCloud
- Connect Amazon Textract to PrivaceraCloud
- Athena
- Privacera Discovery with Cassandra
- Connect Databricks to PrivaceraCloud
- Databricks SQL
- Databricks SQL Overview and Configuration
- Planning and general process
- Prerequisites
- Databricks SQL with Privacera Hive
- Connect Databricks SQL application
- Grant Databricks SQL permissions to PrivaceraCloud users
- Define a resource policy
- Test the policy
- Databricks SQL PolicySync fields
- Configuring column-level access control
- View-based masking functions and row-level filtering
- Create an endpoint in Databricks SQL
- Databricks SQL Fields
- Databricks SQL Hive Service Definition
- Databricks SQL Masking Functions
- Databricks SQL Encryption
- Use a custom policy repository with Databricks
- Connect Databricks SQL to Hive policy repository on PrivaceraCloud
- Databricks SQL Overview and Configuration
- Connect Databricks Unity Catalog to PrivaceraCloud
- Connect S3 to PrivaceraCloud
- Prerequisites in AWS console
- Connect S3 application to PrivaceraCloud
- Enable Privacera Access Management for S3
- Enable Data Discovery for S3
- S3 AWS Commands - Ranger Permission Mapping
- S3
- AWS Access with IAM
- Access AWS S3 buckets from multiple AWS accounts
- Add UserInfo in S3 Requests sent via Dataserver
- Control access to S3 buckets with AWS Lambda function on PrivaceraCloud
- Dremio Plugin
- DynamoDB
- Connect Elastic MapReduce from Amazon application to PrivaceraCloud
- Connect EMR application
- EMR Spark access control types
- PrivaceraCloud configuration
- AWS IAM roles using CloudFormation setup
- Create a security configuration
- Create EMR cluster
- How to configure multiple JSON Web Tokens (JWTs) for EMR
- EMR Native Ranger Integration with PrivaceraCloud
- Connect EMRFS S3 to PrivaceraCloud
- Files
- GBQ
- Google Cloud Storage
- Connect Glue to PrivaceraCloud
- Google BigQuery for PolicySync
- Connect Kinesis to PrivaceraCloud
- Connect Lambda to PrivaceraCloud
- Microsoft SQL Server
- MySQL for Discovery
- Open Source Apache Spark
- Oracle for Discovery
- PostgreSQL
- Connect Power BI to PrivaceraCloud
- Presto
- Redshift
- Snowflake
- Starburst Enterprise with PrivaceraCloud
- Starburst Enterprise Presto
- Trino
- Connect users
- Data access Users, Groups, and Roles
- UserSync
- Portal user LDAP/AD
- Datasource
- Okta Setup for SAML-SSO
- Azure AD setup
- SCIM Server User-Provisioning
- User Management
- Identity
- Access Manager
- Access Manager
- Resource Policies
- Tag Policies
- Scheme Policies
- Service Explorer
- Reports
- Audit
- About data access users, groups, and roles resource policies
- Security zones
- Discovery
- Classifications via random sampling
- Privacera Discovery scan targets
- Propagate Privacera Discovery Tags to Ranger
- Enable offline scanning on Azure Data Lake Storage Gen 2 (ADLS)
- Enable Real-time Scanning of S3 Buckets
- Enable Real-time Scanning on Azure Data Lake Storage Gen 2 (ADLS)
- Enable Discovery Realtime Scanning Using IAM Role
- Encryption
- Overview of Privacera Encryption
- Encryption schemes
- Presentation schemes
- Masking schemes
- Create scheme policies
- Privacera-supplied encryption schemes for the Privacera API
- Privacera-supplied encryption schemes for the Bouncy Castle API
- API date input formats
- Deprecated encryption formats, algorithms, and scopes
- Privacera Encryption REST API
- PEG API endpoint
- PEG REST API encryption endpoints
- Prerequisites
- Common PEG REST API fields
- Construct the datalist for the /protect endpoint
- Deconstruct the response from the /unprotect endpoint
- Example data transformation with the /unprotect endpoint and presentation scheme
- Example PEG API endpoints
- Make encryption API calls on behalf of another user
- Privacera Encryption UDF for masking in Databricks on PrivaceraCloud
- Privacera Encryption UDFs for Trino on PrivaceraCloud
- Syntax of Privacera Encryption UDFs for Trino
- Prerequisites for installing Privacera Crypto plug-in for Trino
- Download and install Privacera Crypto jar
- Set variables in Trino etc/crypto.properties
- Restart Trino to register the Privacera encryption and masking UDFs for Trino
- Example queries to verify Privacera-supplied UDFs
- Privacera Encryption UDF for masking in Trino on PrivaceraCloud
- Encryption UDFs for Apache Spark on PrivaceraCloud
- Launch Pad
- Settings
- Dashboard
- Usage statistics
- Operational status of PrivaceraCloud and RSS feed
- How to Get Support
- Coordinated Vulnerability Disclosure (CVD) Program of Privacera
- Shared Security Model
- PrivaceraCloud Previews
- Preview: File Explorer for S3
- Preview: File Explorer for Azure
- Preview: File Explorer for GCS
- Preview: Scan Generic Records with NER Model
- Preview: Scan Electronic Health Records with NER Model
- Preview: OneLogin setup for SAML-SSO
- Preview: Azure Active Directory SCIM Server UserSync
- Preview: OneLogin UserSync
- Preview: PingFederate UserSync
- Quickstart for Databricks Unity Catalog on PrivaceraCloud
- What do I need to do in my Databricks Workspace?
- Where is the sample dataset in my Databricks Workspace?
- What should I do in the PrivaceraCloud web portal?
- Access use-case - How do I give a user access to a table or restrict from running a SQL select query?
- Access use-case - How do I restrict a user from seeing contents of a column in the result of a SQL select query?
- Column masking use-case - How do I restrict a user from seeing contents of a column by masking the values in the result of a SQL select query?
- Access use-case - How do I disallow a user from seeing certain rows of a table?
- PrivaceraCloud documentation changelog
About data access users, groups, and roles resource policies
The Access Manager > Users/Groups/Roles page is for managing data access users, groups, and roles.
Data access users can be allowed or denied use of data stored in connected applications, as opposed to portal users, who are users that can log into your PrivaceraCloud account.
Users
You use data access users when you define resource policies. Users can be included or excluded specifically or in groups for allowed or denied access
The User Source field indicates the method of their creation or import (source).
The internal administrative "users": admin, rangerusersync, keyadmin, rangertagsync, and {OWNER} are automatically defined when your PrivaceraCloud account is created. Additional Internal users can also be created in this dialog using the +Add button dialog.
External users can be any of the following:
A data access user with the same username as the account administrator user.
A service user. A service user is automatically created by PrivaceraCloud for each connected application service and is named for the service (e.g. hive, s3, ...). Service names are reserved and cannot be reused.
Users imported via UserSync from LDAP or Active Directory.
See Connect users for information on importing users.
The Visibility field indicates if a user record is listed or available when creating or editing a resource policy with Access Manager. If a user record is visible, you can find it under Select User. If a user record is Hidden, it is not selectable. This is useful when your account has been synchronized with a user directory with a large number of users. Visibility can be set by selecting a user object row (on the left side of the table, and using the Visibility action (between +Add and Delete).
User Role applies to individual data access users: User, Admin, Auditor, or KeyAdmin}.
User Attributes, see User/Group Attributes below.
Use Search to filter displayed objects by a specific value. First select a column name, then a value.
User objects can be added, edited, or deleted.
Groups
Groups are collections of associated users. Users can be members of more than one group. Similar to user objects, groups are used in definition of resource policies. Groups can be included or excluded specifically or in association with other groups for allowed or denied access.
All functions for users are also available for groups: add/delete, hide/show, and search.
User/Group Attributes
Attributes are fields that can be added to Users and Groups to
Only Admin users have access to change attributes. Other users are unable to view or edit attributes.
Modifications to attributes are limited to the Ranger DB and have no impact on the source.
Only the values can be changed. These values are considered as a single string (multiple comma-separated values cannot be added).
Internal UserSync attributes such as
full_name
,service_id
, andsync_source
cannot be changed or removed. If these internal UserSync attributes are added manually through the UI for an internal user, no further modification or deletion will be permitted.When Ranger UserSync is restarted, the attributes from the source are overridden, but the custom attributes added from the UI are retained.
If a user exists in more than one location, such as LDAP and Azure, if you sync that user from both sources the attributes will be merged. If there are common attributes, only the attribute value from the most recent source will be retained.
If an attribute is deleted from the source or UserSync, it will still be visible in the UI. If it is no longer required, you can delete it manually.
Roles
With the Roles tab, you can create custom roles used for use when you define data access policies. Custom roles are distinct from data access imported roles and user roles.
Click +Add New Role to create a new custom role. At least one user, group, or role must be selected. Use the dropdown to select the desired users, groups, or roles. Under the column Is Role Admin, set one or more existing users, groups, or roles to be a role administrator.