Skip to content

Load Only Masking ACLs

To configure the connector to load only masking-related ACLs and skip access-control ACLs, enable the following setting:

  • Default value: false
  • When set to true, PolicySync loads only masking policies and does not load access-control ACLs.
  • Useful when access control is managed externally and Privacera is used only for data masking.
YAML
1
CONNECTOR_DATABRICKS_UNITY_CATALOG_PERMISSION_LOADER_LOAD_ONLY_MASKING_ACLS: "true"

PrivaceraCloud Equivalent

Properties
1
ranger.policysync.connector.0.permission.loader.load.only.masking.acls=true

Setup

  1. Navigate to Settings → Applications in the Self-Managed Portal.

  2. From the list of Connected Applications, select Databricks Unity Catalog.

  3. Click on the application name or the icon to edit. Then, go to the Access Management tab.

  4. Under the ADVANCED tab, under Add New Custom Properties, add:

    Properties
    1
    ranger.policysync.connector.0.permission.loader.load.only.masking.acls=true

  5. Click SAVE to apply the changes.

  1. SSH to the instance where Privacera Manager is installed.

  2. Open the connector variables file:

    If you have multiple connectors, replace instance1 with the appropriate connector instance name.

    Bash
    1
    vi ~/privacera/privacera-manager/config/custom-vars/connectors/databricks-unity-catalog/instance1/vars.connector.databricks.unity.catalog.yml

  3. Add or update the property (omit or set to false to load access-control ACLs as well):

    YAML
    1
    CONNECTOR_DATABRICKS_UNITY_CATALOG_PERMISSION_LOADER_LOAD_ONLY_MASKING_ACLS: "true"

  4. Run the following commands to update your Privacera Manager platform instance:

    Step 1 - Setup which generates the helm charts. This step usually takes few minutes.

    Bash
    1
2
    cd ~/privacera/privacera-manager
./privacera-manager.sh setup
    Step 2 - Apply the Privacera Manager helm charts.
    Bash
    1
2
    cd ~/privacera/privacera-manager
./pm_with_helm.sh upgrade
    Step 3 - (Optional) Post-installation step which generates Plugin tar ball, updates Route 53 DNS and so on. This step is not required if you are updating only connector properties.

    Bash
    1
2
    cd ~/privacera/privacera-manager
./privacera-manager.sh post-install

  1. In the PrivaceraCloud portal, go to Settings → Applications.

  2. On Connected Applications, select Databricks Unity Catalog and open the application for edit.

  3. Go to Access Management → ADVANCED.

  4. Under Add New Custom Properties, add (replace 0 with your connector index if needed):

    Properties
    1
    ranger.policysync.connector.0.permission.loader.load.only.masking.acls=true

  5. Click SAVE to apply the changes.