Skip to content

Skip Implicit USE CATALOG and USE SCHEMA Grants

Configure the Databricks Unity Catalog connector to stop sending USE CATALOG and USE SCHEMA grants with every table grant, and give these privileges once through two policies instead. This reduces the number of grants the connector sends to Databricks.

Overview

To read a table in Unity Catalog, a user needs USE CATALOG on the catalog, USE SCHEMA on the schema and SELECT on the table. By default, the connector sends all three for every table grant.

When this feature is enabled:

  • The connector sends only the table grant (for example SELECT). Grants created for view-based masking, view-based row filters, secure views or data admin still include USE CATALOG and USE SCHEMA.
  • Users get USE CATALOG and USE SCHEMA from two policies for the public group (see Prerequisites).
  • On a catalog or schema that these policies do not cover, the connector keeps sending USE CATALOG and USE SCHEMA as before, and logs a warning that names it.

Explicit USE CATALOG / USE SCHEMA grants from your own policies are not affected.

Keep the prerequisite policies in place

Once the feature has been enabled, users rely on the prerequisite policies for USE CATALOG and USE SCHEMA. Do not remove these policies, even if you turn the feature off later.

Prerequisites

Create these policies after you enable the feature, as described in Rollout order.

  1. Create two policies for the group public:

    Policy Resource Permission Principal
    A catalog * Use Catalog group public
    B catalog *, schema * Use Schema group public

  2. Create them in every security zone that has Unity Catalog resources, and also outside zones if you have resources that are not in a zone.

  3. Keep the connector's default Databricks native public group setting, so that public maps to the Databricks account users group (see Using Databricks Native Public Group).

  4. Make sure no policy denies public access at catalog or schema level.

Configuration property

Property Custom property (Portal and PrivaceraCloud) Default
CONNECTOR_DATABRICKS_UNITY_CATALOG_SKIP_IMPLICIT_USAGE_GRANTS ranger.policysync.connector.0.skip.implicit.usage.grants false

Set it to true to enable the feature.

Rollout order

  1. Enable the feature (see Setup) and restart the connector.
  2. Create policies A and B, as described in Prerequisites.
  3. Check that a user with only a table-level grant can query the table.

Tip

Enable the feature before you create the policies. Creating the policies first makes the connector re-send USE grants for every catalog and schema, which can slow down sync.

Setup

  1. Navigate to Settings → Applications in the Self-Managed Portal.

  2. From the list of Connected Applications, select Databricks Unity Catalog.

  3. Select the application name or the icon to edit. Then, go to the Access Management tab.

  4. Under the ADVANCED tab, under Add New Custom Properties, add:

    Properties
    1
    ranger.policysync.connector.0.skip.implicit.usage.grants=true

  5. Select SAVE to apply the changes.

  1. SSH to the instance where Privacera Manager is installed.

  2. Run the following command to open the .yml file to be edited.

    If you have multiple connectors, then replace instance1 with the appropriate connector instance name.

    Bash
    vi ~/privacera/privacera-manager/config/custom-vars/connectors/databricks-unity-catalog/instance1/vars.connector.databricks.unity.catalog.yml

  3. Add or set the following property:

    YAML
    1
    CONNECTOR_DATABRICKS_UNITY_CATALOG_SKIP_IMPLICIT_USAGE_GRANTS: "true"

  4. Once the property is configured, run the following commands to update your Privacera Manager platform instance:

    Step 1 - Setup which generates the helm charts. This step usually takes few minutes.

    Bash
    1
2
    cd ~/privacera/privacera-manager
./privacera-manager.sh setup
    Step 2 - Apply the Privacera Manager helm charts.
    Bash
    1
2
    cd ~/privacera/privacera-manager
./pm_with_helm.sh upgrade
    Step 3 - (Optional) Post-installation step which generates Plugin tar ball, updates Route 53 DNS and so on. This step is not required if you are updating only connector properties.

    Bash
    1
2
    cd ~/privacera/privacera-manager
./privacera-manager.sh post-install

  1. In PrivaceraCloud portal, navigate to Settings → Applications.

  2. On the Connected Applications screen, select Databricks Unity Catalog.

  3. Select the pen icon or the Account Name to modify the settings.

  4. On the Edit Application screen, go to Access Management → ADVANCED tab.

  5. Under Add New Custom Properties, add:

    Properties
    1
    ranger.policysync.connector.0.skip.implicit.usage.grants=true

  6. Select SAVE to apply the changes.