Skip to content

Manage Permissions List

This section provides configuration details for managing Unity Catalog permissions using the Permission Management feature. This feature was introduced to support newly added permissions and allows you to explicitly control whether these permissions should be managed by the connector or excluded from management until policies are defined.

Prerequisites

Note

By default, the connector excludes all newly supported permissions and takes no action on them until they are explicitly included using the Inclusion Property.

Setup

The permission management feature provides two types of configuration properties that can be set via vars.connector.databricks.unity.catalog.yml under custom-vars.

  1. Inclusion Property: For newly supported permissions.
  2. Exclusion Property: For all supported permissions (both legacy and newly supported).

Inclusion Property

  • The Inclusion Property allows to enable the connector to manage newly supported permissions for specific Unity Catalog resources. If not included, the connector will skip managing those permissions.

  • Example:

    YAML
    CONNECTOR_DATABRICKS_UNITY_CATALOG_TABLE_CUSTOM_INCLUDE_PERMISSIONS_LIST: "SELECT,MODIFY"

This property only applies to newly supported permissions that are excluded by default.

  • Available Properties

    Property Description
    CONNECTOR_DATABRICKS_UNITY_CATALOG_CATALOG_CUSTOM_INCLUDE_PERMISSIONS_LIST Comma-separated list of newly supported permissions for the CATALOG resource that are to be managed by the Connector
    CONNECTOR_DATABRICKS_UNITY_CATALOG_SCHEMA_CUSTOM_INCLUDE_PERMISSIONS_LIST Comma-separated list of newly supported permissions for the SCHEMA resource that are to be managed by the Connector
    CONNECTOR_DATABRICKS_UNITY_CATALOG_TABLE_CUSTOM_INCLUDE_PERMISSIONS_LIST Comma-separated list of newly supported permissions for the TABLE resource that are to be managed by the Connector
    CONNECTOR_DATABRICKS_UNITY_CATALOG_VIEW_CUSTOM_INCLUDE_PERMISSIONS_LIST Comma-separated list of newly supported permissions for the VIEW resource that are to be managed by the Connector
    CONNECTOR_DATABRICKS_UNITY_CATALOG_MATERIALIZED_VIEW_CUSTOM_INCLUDE_PERMISSIONS_LIST Comma-separated list of newly supported permissions for the MATERIALIZED VIEW resource that are to be managed by the Connector
    CONNECTOR_DATABRICKS_UNITY_CATALOG_COLUMN_CUSTOM_INCLUDE_PERMISSIONS_LIST Comma-separated list of newly supported permissions for the COLUMN resource that are to be managed by the Connector
    CONNECTOR_DATABRICKS_UNITY_CATALOG_FUNCTION_CUSTOM_INCLUDE_PERMISSIONS_LIST Comma-separated list of newly supported permissions for the FUNCTION resource that are to be managed by the Connector
    CONNECTOR_DATABRICKS_UNITY_CATALOG_EXTERNAL_LOCATION_CUSTOM_INCLUDE_PERMISSIONS_LIST Comma-separated list of newly supported permissions for the EXTERNAL LOCATION resource that are to be managed by the Connector
    CONNECTOR_DATABRICKS_UNITY_CATALOG_STORAGE_CREDENTIAL_CUSTOM_INCLUDE_PERMISSIONS_LIST Comma-separated list of newly supported permissions for the STORAGE CREDENTIAL resource that are to be managed by the Connector
    CONNECTOR_DATABRICKS_UNITY_CATALOG_VOLUME_CUSTOM_INCLUDE_PERMISSIONS_LIST Comma-separated list of newly supported permissions for the VOLUME resource that are to be managed by the Connector

Exclusion Property

  • The Exclusion Property allows to exclude any permissions (both legacy and newly supported) from being managed by the connector. This property takes precedence over the Inclusion Property.

  • You can specify permissions to exclude for each resource individually. To exclude all permissions for a resource, use *.

  • Example:

    YAML
    CONNECTOR_DATABRICKS_UNITY_CATALOG_VIEW_CUSTOM_EXCLUDE_PERMISSIONS_LIST: "SELECT"

  • Exclude All Example:

    YAML
    CONNECTOR_DATABRICKS_UNITY_CATALOG_FUNCTION_CUSTOM_EXCLUDE_PERMISSIONS_LIST: "*"

The Exclusion property has the highest precedence. If a permission is listed under both Inclusion and Exclusion, the connector will not manage that permission.

  • Available Properties

    Property Description
    CONNECTOR_DATABRICKS_UNITY_CATALOG_CATALOG_CUSTOM_EXCLUDE_PERMISSIONS_LIST Comma-separated list of permissions to be excluded from the CATALOG resource
    CONNECTOR_DATABRICKS_UNITY_CATALOG_SCHEMA_CUSTOM_EXCLUDE_PERMISSIONS_LIST Comma-separated list of permissions to be excluded from the SCHEMA resource
    CONNECTOR_DATABRICKS_UNITY_CATALOG_TABLE_CUSTOM_EXCLUDE_PERMISSIONS_LIST Comma-separated list of permissions to be excluded from the TABLE resource
    CONNECTOR_DATABRICKS_UNITY_CATALOG_VIEW_CUSTOM_EXCLUDE_PERMISSIONS_LIST Comma-separated list of permissions to be excluded from the VIEW resource
    CONNECTOR_DATABRICKS_UNITY_CATALOG_MATERIALIZED_VIEW_CUSTOM_EXCLUDE_PERMISSIONS_LIST Comma-separated list of permissions to be excluded from the MATERIALIZED VIEW resource
    CONNECTOR_DATABRICKS_UNITY_CATALOG_COLUMN_CUSTOM_EXCLUDE_PERMISSIONS_LIST Comma-separated list of permissions to be excluded from the COLUMN resource
    CONNECTOR_DATABRICKS_UNITY_CATALOG_FUNCTION_CUSTOM_EXCLUDE_PERMISSIONS_LIST Comma-separated list of permissions to be excluded from the FUNCTION resource
    CONNECTOR_DATABRICKS_UNITY_CATALOG_EXTERNAL_LOCATION_CUSTOM_EXCLUDE_PERMISSIONS_LIST Comma-separated list of permissions to be excluded from the EXTERNAL LOCATION resource
    CONNECTOR_DATABRICKS_UNITY_CATALOG_STORAGE_CREDENTIAL_CUSTOM_EXCLUDE_PERMISSIONS_LIST Comma-separated list of permissions to be excluded from the STORAGE CREDENTIAL resource
    CONNECTOR_DATABRICKS_UNITY_CATALOG_VOLUME_CUSTOM_EXCLUDE_PERMISSIONS_LIST Comma-separated list of permissions to be excluded from the VOLUME resource

Warning

  • Replace the example values with your actual permissions.

  1. Navigate to Settings → Applications in the Self-Managed Portal.

  2. From the list of Connected Applications, select Databricks Unity Catalog.

  3. Click on the application name or the icon to edit. Then, go to the Access Management tab.

  4. Under Add New Custom Properties add the following properties to include specific permissions to be managed by the connector:

    Bash
     1
 2
 3
 4
 5
 6
 7
 8
 9
10
    ranger.policysync.connector.0.catalog.custom.include.permissions=Manage
ranger.policysync.connector.0.schema.custom.include.permissions=Manage
ranger.policysync.connector.0.table.custom.include.permissions=Manage
ranger.policysync.connector.0.view.custom.include.permissions=Manage
ranger.policysync.connector.0.materialized_view.custom.include.permissions=Manage
ranger.policysync.connector.0.column.custom.include.permissions=Manage
ranger.policysync.connector.0.function.custom.include.permissions=Manage
ranger.policysync.connector.0.external_location.custom.include.permissions=Manage
ranger.policysync.connector.0.storage_credential.custom.include.permissions=Manage
ranger.policysync.connector.0.volume.custom.include.permissions=Manage

  5. Add the following properties to exclude the permissions to be managed by the connector:

    Bash
     1
 2
 3
 4
 5
 6
 7
 8
 9
10
    ranger.policysync.connector.0.catalog.custom.exclude.permissions=Create Schema
ranger.policysync.connector.0.schema.custom.exclude.permissions=Create Table
ranger.policysync.connector.0.table.custom.exclude.permissions=Select
ranger.policysync.connector.0.view.custom.exclude.permissions=Select
ranger.policysync.connector.0.materialized_view.custom.exclude.permissions=Manage
ranger.policysync.connector.0.column.custom.exclude.permissions=Select
ranger.policysync.connector.0.function.custom.exclude.permissions=Execute
ranger.policysync.connector.0.external_location.custom.exclude.permissions=Create External Table
ranger.policysync.connector.0.storage_credential.custom.exclude.permissions=Create External Location
ranger.policysync.connector.0.volume.custom.exclude.permissions=Read Volume

  6. Click SAVE to apply the changes.

  1. SSH to the instance where Privacera Manager is installed.

  2. Run the following command to open the .yml file to be edited.

    If you have multiple connectors, then replace instance1 with the appropriate connector instance name.

    Bash
    vi ~/privacera/privacera-manager/config/custom-vars/connectors/databricks-unity-catalog/instance1/vars.connector.databricks.unity.catalog.yml

  3. Uncomment (if commented) and set the following properties to include specific permissions to be managed by the connector:

    YAML
     1
 2
 3
 4
 5
 6
 7
 8
 9
10
    CONNECTOR_DATABRICKS_UNITY_CATALOG_CATALOG_CUSTOM_INCLUDE_PERMISSIONS_LIST: "Manage"
CONNECTOR_DATABRICKS_UNITY_CATALOG_SCHEMA_CUSTOM_INCLUDE_PERMISSIONS_LIST: "Manage"
CONNECTOR_DATABRICKS_UNITY_CATALOG_TABLE_CUSTOM_INCLUDE_PERMISSIONS_LIST: "Manage"
CONNECTOR_DATABRICKS_UNITY_CATALOG_VIEW_CUSTOM_INCLUDE_PERMISSIONS_LIST: "Manage"
CONNECTOR_DATABRICKS_UNITY_CATALOG_MATERIALIZED_VIEW_CUSTOM_INCLUDE_PERMISSIONS_LIST: "Manage"
CONNECTOR_DATABRICKS_UNITY_CATALOG_COLUMN_CUSTOM_INCLUDE_PERMISSIONS_LIST: "Manage"
CONNECTOR_DATABRICKS_UNITY_CATALOG_FUNCTION_CUSTOM_INCLUDE_PERMISSIONS_LIST: "Manage"
CONNECTOR_DATABRICKS_UNITY_CATALOG_EXTERNAL_LOCATION_CUSTOM_INCLUDE_PERMISSIONS_LIST: "Manage"
CONNECTOR_DATABRICKS_UNITY_CATALOG_STORAGE_CREDENTIAL_CUSTOM_INCLUDE_PERMISSIONS_LIST: "Manage"
CONNECTOR_DATABRICKS_UNITY_CATALOG_VOLUME_CUSTOM_INCLUDE_PERMISSIONS_LIST: "Manage"

  4. Uncomment (if commented) and set the following properties to exclude the permissions to be managed by the connector:

    YAML
     1
 2
 3
 4
 5
 6
 7
 8
 9
10
    CONNECTOR_DATABRICKS_UNITY_CATALOG_CATALOG_CUSTOM_EXCLUDE_PERMISSIONS_LIST: "Create Schema"
CONNECTOR_DATABRICKS_UNITY_CATALOG_SCHEMA_CUSTOM_EXCLUDE_PERMISSIONS_LIST: "Create Table"
CONNECTOR_DATABRICKS_UNITY_CATALOG_TABLE_CUSTOM_EXCLUDE_PERMISSIONS_LIST: "Select"
CONNECTOR_DATABRICKS_UNITY_CATALOG_VIEW_CUSTOM_EXCLUDE_PERMISSIONS_LIST: "Select"
CONNECTOR_DATABRICKS_UNITY_CATALOG_MATERIALIZED_VIEW_CUSTOM_EXCLUDE_PERMISSIONS_LIST: "Manage"
CONNECTOR_DATABRICKS_UNITY_CATALOG_COLUMN_CUSTOM_EXCLUDE_PERMISSIONS_LIST: "Select"
CONNECTOR_DATABRICKS_UNITY_CATALOG_FUNCTION_CUSTOM_EXCLUDE_PERMISSIONS_LIST: "Execute"
CONNECTOR_DATABRICKS_UNITY_CATALOG_EXTERNAL_LOCATION_CUSTOM_EXCLUDE_PERMISSIONS_LIST: "Create External Table"
CONNECTOR_DATABRICKS_UNITY_CATALOG_STORAGE_CREDENTIAL_CUSTOM_EXCLUDE_PERMISSIONS_LIST: "Create External Location"
CONNECTOR_DATABRICKS_UNITY_CATALOG_VOLUME_CUSTOM_EXCLUDE_PERMISSIONS_LIST: "Read Volume"

  5. Once the properties are configured, run the following commands to update your Privacera Manager platform instance:

    Step 1 - Setup which generates the helm charts. This step usually takes few minutes.

    Bash
    1
2
    cd ~/privacera/privacera-manager
./privacera-manager.sh setup
    Step 2 - Apply the Privacera Manager helm charts.
    Bash
    1
2
    cd ~/privacera/privacera-manager
./pm_with_helm.sh upgrade
    Step 3 - Post-installation step which generates Plugin tar ball, updates Route 53 DNS and so on.

    Bash
    1
2
    cd ~/privacera/privacera-manager
./privacera-manager.sh post-install

  1. In PrivaceraCloud portal, navigate to Settings -> Applications.

  2. On the Connected Applications screen, select Databricks Unity Catalog.

  3. Click the pen icon or the Account Name to modify the settings.

  4. On the Edit Application screen, go to Access Management -> ADVANCED tab.

  5. Under Add New Custom Properties add the following properties to include specific permissions to be managed by the connector:

    Bash
     1
 2
 3
 4
 5
 6
 7
 8
 9
10
    ranger.policysync.connector.0.catalog.custom.include.permissions=Manage
ranger.policysync.connector.0.schema.custom.include.permissions=Manage
ranger.policysync.connector.0.table.custom.include.permissions=Manage
ranger.policysync.connector.0.view.custom.include.permissions=Manage
ranger.policysync.connector.0.materialized_view.custom.include.permissions=Manage
ranger.policysync.connector.0.column.custom.include.permissions=Manage
ranger.policysync.connector.0.function.custom.include.permissions=Manage
ranger.policysync.connector.0.external_location.custom.include.permissions=Manage
ranger.policysync.connector.0.storage_credential.custom.include.permissions=Manage
ranger.policysync.connector.0.volume.custom.include.permissions=Manage

  6. Add the following properties to exclude the permissions to be managed by the connector:

    Bash
     1
 2
 3
 4
 5
 6
 7
 8
 9
10
    ranger.policysync.connector.0.catalog.custom.exclude.permissions=Create Schema
ranger.policysync.connector.0.schema.custom.exclude.permissions=Create Table
ranger.policysync.connector.0.table.custom.exclude.permissions=Select
ranger.policysync.connector.0.view.custom.exclude.permissions=Select
ranger.policysync.connector.0.materialized_view.custom.exclude.permissions=Manage
ranger.policysync.connector.0.column.custom.exclude.permissions=Select
ranger.policysync.connector.0.function.custom.exclude.permissions=Execute
ranger.policysync.connector.0.external_location.custom.exclude.permissions=Create External Table
ranger.policysync.connector.0.storage_credential.custom.exclude.permissions=Create External Location
ranger.policysync.connector.0.volume.custom.exclude.permissions=Read Volume

  7. Click SAVE to apply the changes.

Comments