Skip to content

Manage Resources List

Runtime tab

The Runtime tab describes the Omni Connector on a Runtime Plane, which is a separate connector from PolicySync. Sections without a Runtime tab apply to PolicySync only.

You can configure the Databricks Unity Catalog connector to manage access control policies for specific schemas, tables/views, and functions. You can specify lists to include and exclude resources. The connector manages access control policies for resources in the include list and ignores resources in the exclude list. If a resource is in the exclude list, the connector does not manage it, even if it is also in the include list.

Use the following properties to specify comma-separated schemas, tables/views, and functions whose access control should be managed by PolicySync. To manage all resources, do not specify these properties. You can use wildcard characters (*) to match multiple schemas, tables, or functions.

Example:

  • Schemas: test_catalog1.schema1,test_catalog2*.sales*
  • Tables/Views: test_catalog1.schema1.table1,test_catalog2*.sales*.view*
  • Functions: test_catalog1.schema1.function1,test_catalog2*.sales*.func*

Prerequisites

For managing external locations and storage credentials, the service user must have the MANAGE privilege on the external location and storage credential. Here is an example of how to grant the MANAGE privilege:

If you have provided the METASTORE ADMIN privilege to the service user, then you can skip these privilege.

For external locations:

SQL
1
GRANT MANAGE ON EXTERNAL LOCATION `LOCATION_NAME` TO `PRIVACEA_SERVICE_USER`;

For storage credentials:

SQL
1
GRANT MANAGE ON STORAGE CREDENTIAL `STORAGE_CREDENTIAL_NAME` TO `PRIVACEA_SERVICE_USER`;

Setup

Warning

  • Values are case-sensitive.
  • Provide fully qualified names for schemas, tables/views, functions, and models. For example: catalog1.schema1.*
  • Replace the example values with your actual resource names.
  • Service Credentials are only supported for connectors configured to use a JDBC connection to load resources.

  1. Navigate to Settings → Applications in the Self-Managed Portal.

  2. From the list of Connected Applications, select Databricks Unity Catalog.

  3. Click on the application name or the icon to edit. Then, go to the Access Management tab.

  4. In the BASIC tab, specify the following resources to include:

    • Catalogs to manage access control policies: test_catalog1
    • Schemas to manage access control policies: test_catalog1.schema1
    • Tables to manage access control policies: test_catalog1.schema1.table1

  5. In the ADVANCED tab, specify the following resources to include:

    • External locations to manage access control policies: sales_location*
    • Storage credentials to manage access control policies: sales_location*
    • Connection to manage access control policies: sales_connection1
    • User defined functions to manage access control policies: test_catalog1.schema1.function1
    • Volumes to manage access control policies for: test_catalog1.schema1.volume1
    • Add below mentioned properties in the Custom Properties Text Box to manage access control policies for respective resources
      Text Only
      1
2
      ranger.policysync.connector.0.manage.model.list=test_catalog1.schema1.model1
ranger.policysync.connector.0.manage.service_credential.list=sales_service_cred

  6. For excluding resources, enter the following values in the ADVANCED tab:

    • Catalogs to ignore while setting access control policies: test_catalog1
    • Schemas to ignore while setting access control policies: test_catalog1.schema1
    • Tables to ignore while setting access control policies: test_catalog1.schema1.table1
    • External locations to ignore while setting access control policies: sales_location*
    • Storage credentials to ignore while setting access control policies: sales_location*
    • Connection to ignore while setting access control policies: sales_connection1
    • User defined functions to ignore while setting access control policies: test_catalog1.schema1.function1
    • Volumes to ignore while setting access control policies for: test_catalog1.schema1.volume1
    • Add below mentioned properties in the Custom Properties Text Box to ignore while setting access control policies for respective resources
      Text Only
      1
2
      ranger.policysync.connector.0.ignore.model.list=test_catalog1.schema1.model1
ranger.policysync.connector.0.ignore.service_credential.list=sales_service_cred

  7. Click SAVE to apply the changes.

  1. SSH to the instance where Privacera Manager is installed.

  2. Run the following command to open the .yml file to be edited.

    If you have multiple connectors, then replace instance1 with the appropriate connector instance name.

    Bash
    1
    vi ~/privacera/privacera-manager/config/custom-vars/connectors/databricks-unity-catalog/instance1/vars.connector.databricks.unity.catalog.yml

  3. Set the following properties to enable the connector to manage the permissions for schemas, tables/views, and other resources in the Databricks Unity Catalog:

    YAML
    1
2
3
4
5
6
7
8
    CONNECTOR_DATABRICKS_UNITY_CATALOG_MANAGE_CATALOG_LIST: "test_catalog"
CONNECTOR_DATABRICKS_UNITY_CATALOG_MANAGE_SCHEMA_LIST: "test_catalog1.schema1"
CONNECTOR_DATABRICKS_UNITY_CATALOG_MANAGE_TABLE_LIST: "test_catalog1.schema1.table1"
CONNECTOR_DATABRICKS_UNITY_CATALOG_MANAGE_FUNCTION_LIST: "test_catalog1.schema1.function1"
CONNECTOR_DATABRICKS_UNITY_CATALOG_MANAGE_EXTERNAL_LOCATION_LIST: "sales_location*"
CONNECTOR_DATABRICKS_UNITY_CATALOG_MANAGE_STORAGE_CREDENTIAL_LIST: "sales_location*"
CONNECTOR_DATABRICKS_UNITY_CATALOG_MANAGE_MODEL_LIST: "test_catalog1.schema1.model1"
CONNECTOR_DATABRICKS_UNITY_CATALOG_MANAGE_SERVICE_CREDENTIAL_LIST: "sales_service_cred"

  4. For excluding resources, set the following properties:

    YAML
    1
2
3
4
5
6
7
8
    CONNECTOR_DATABRICKS_UNITY_CATALOG_IGNORE_CATALOG_LIST: "test_catalog1"
CONNECTOR_DATABRICKS_UNITY_CATALOG_IGNORE_SCHEMA_LIST: "test_catalog1.schema1"
CONNECTOR_DATABRICKS_UNITY_CATALOG_IGNORE_TABLE_LIST: "test_catalog1.schema1.table1"
CONNECTOR_DATABRICKS_UNITY_CATALOG_IGNORE_FUNCTION_LIST: "test_catalog1.schema1.function1"
CONNECTOR_DATABRICKS_UNITY_CATALOG_IGNORE_EXTERNAL_LOCATION_LIST: "external_location1"
CONNECTOR_DATABRICKS_UNITY_CATALOG_IGNORE_STORAGE_CREDENTIAL_LIST: "storage_credential1"
CONNECTOR_DATABRICKS_UNITY_CATALOG_IGNORE_MODEL_LIST: "test_catalog1.schema1.model1"
CONNECTOR_DATABRICKS_UNITY_CATALOG_IGNORE_SERVICE_CREDENTIAL_LIST: "sales_service_cred"

  5. Once the properties are configured, run the following commands to update your Privacera Manager platform instance:

    Step 1 - Setup which generates the helm charts. This step usually takes few minutes.

    Bash
    1
2
    cd ~/privacera/privacera-manager
./privacera-manager.sh setup
    Step 2 - Apply the Privacera Manager helm charts.
    Bash
    1
2
    cd ~/privacera/privacera-manager
./pm_with_helm.sh upgrade
    Step 3 - (Optional) Post-installation step which generates Plugin tar ball, updates Route 53 DNS and so on. This step is not required if you are updating only connector properties.

    Bash
    1
2
    cd ~/privacera/privacera-manager
./privacera-manager.sh post-install

  1. In PrivaceraCloud portal, navigate to Settings -> Applications.

  2. On the Connected Applications screen, select Databricks Unity Catalog.

  3. Click the pen icon or the Account Name to modify the settings.

  4. On the Edit Application screen, go to Access Management -> ADVANCED tab.

  5. For including resources, enter the following values in the respective fields:

    • Schemas to set access control policies: test_catalog1.schema1
    • Tables to set access control policies: test_catalog1.schema1.table1
    • User defined functions to set access control policies: test_catalog1.schema1.function1
    • External locations to set access control policies: Enable this option to manage permissions for external locations.
    • Add below mentioned properties in the Custom Properties Text Box to manage access control policies for respective resources
      Text Only
      1
2
      ranger.policysync.connector.0.manage.service_credential.list=sales_service_cred
ranger.policysync.connector.0.manage.model.list=test_catalog1.schema1.model1

  6. For excluding resources, enter the following values in the respective fields:

    • Catalogs to ignore while setting access control policies: test_catalog1
    • Schemas to ignore while setting access control policies: test_catalog1.schema1
    • Tables to ignore while setting access control policies: test_catalog1.schema1.table1
    • User defined functions to ignore while setting access control policies: test_catalog1.schema1.function1
    • External locations to ignore while setting access control policies: external_location1
    • Storage credentials to ignore while setting access control policies: storage_credential1
    • Add below mentioned properties in the Custom Properties Text Box to ignore while setting access control policies for respective resources
      Text Only
      1
2
      ranger.policysync.connector.0.ignore.service_credential.list=sales_service_cred
ranger.policysync.connector.0.ignore.model.list=test_catalog1.schema1.model1

  7. Click SAVE to apply the changes.

  1. In the portal, navigate to Settings → Runtime Plane and open your Runtime Plane.

  2. Open the Connectors tab and open your Databricks Unity Catalog connector.

  3. Go to ACCESS CONTROL CONFIGS and expand Managed Resources.

  4. Under Include, enter one name or wildcard pattern per line. Names are dot-separated, as catalog.schema.table:

    Text Only
    1
2
3
    test_catalog1.schema1
test_catalog1.schema2.table1
test_catalog2*.sales*

  5. Under Exclude, enter the resources to ignore, one per line. Exclude takes precedence over Include:

    Text Only
    1
    test_catalog1.schema1.table2

  6. Under Resource types governed, add the resource types to govern. Leave it empty to use the defaults: SCHEMA, TABLE and VIEW. To manage other resources, add their types, for example:

    Text Only
    1
    SCHEMA, TABLE, VIEW, VOLUME, FUNCTION, MODEL

  7. Select Save.

Note

  • There are no separate lists for volumes, functions, models, external locations, storage credentials, connections or service credentials. Add the resource type to Resource types governed, and name the resources under Include. Available types: CATALOG, SCHEMA, TABLE, VIEW, MATERIALIZED_VIEW, VOLUME, FUNCTION, MODEL (listed, not scanned yet), EXTERNAL_LOCATION, STORAGE_CREDENTIAL, CONNECTION, SERVICE_CREDENTIAL, EXTERNAL_METADATA (listed, not scanned yet) and CLEAN_ROOM (listed, not scanned yet).
  • * and ? match within one segment. A shorter pattern covers everything below it, so test_catalog1.schema1 covers every object in that schema.
  • A new connector governs nothing until you add an Include entry. Include is empty by default, which means deny-all. Enter * alone to govern everything.
  • Narrowing the scope does not delete anything or revoke grants. Resources that fall out of scope are kept and marked as ungoverned.

For more details, see Managed resources.

For managing multiple MetaStores or using multiple connectors per MetaStore, refer to Multiple MetaStores and Connectors.