Skip to main content

Privacera Platform

Table of Contents

Default services configuration

:

Policy Store

AWS Aurora DB (PostgreSQL/MySQL)
RDS - Aurora DB
PostgreSQL

This topic allows you to configure External RDS Aurora DB with PostGres flavour for Portal, Ranger, Ranger KMS, Access Request Manager.

Prerequisites

Before you begin, ensure the following prerequisites are met:

  • Create RDS Aurora DB with PostGres flavour with a database name. You'll need to use the database name in the Configuration section below.

    Note

    The RDS database name which you will be entering in the Configuration section below should be created in advance. Privacera does not create a RDS database, but only creates table schemas.

  • If you have installed Privacera using the internal Maria DB and wish to move from the internal database to an external PostgreSQL DB, then you will have to delete the Maria DB container/pod. For more information, see Service Commands.

CLI configuration
  1. SSH to the instance where Privacera is installed.

  2. Run the following command.

    cd ~/privacera/privacera-manager
    cp config/sample-vars/vars.external.db.postgres.yml config/custom-vars/
    vi config/custom-vars/vars.external.db.postgres.yml
    
  3. In this file set values for the following:

    Set the following as False.

    DB_INSTALL_MARIADB: "false"
    

    Enter the hostname of the AWS PostgreSQL server, and the name of the database you want to connect to. Get the name of the database from the Prerequisites section above.

    EXTERNAL_DB_HOST: "<PLEASE_CHANGE>"
    EXTERNAL_DB_NAME: "<PLEASE_CHANGE>"                              

    Enter the credentials of the user who has access to the database.

    EXTERNAL_DB_USER: "<PLEASE_CHANGE>"
    EXTERNAL_DB_PASSWORD: "<PLEASE_CHANGE>"                              

    (Optional) Enter a database name for Privacera Portal, Privacera Ranger, and Privacera Ranger KMS. It is recommended to provide different names for the 3 databases.

    PRIVACERA_PORTAL_DB_NAME: "{{EXTERNAL_DB_NAME}}"
    PRIVACERA_RANGER_DB_NAME: "{{EXTERNAL_DB_NAME}}"
    PRIVACERA_RANGER_KMS_DB_NAME: "{{EXTERNAL_DB_NAME}}"                              

    Save and Exit.

  4. Run the following command.

    cd ~/privacera/privacera-manager
    ./privacera-manager.sh update
    
MySQL

This topic allows you to configure External RDS Aurora DB with MySQL flavour for Portal, Ranger, Ranger KMS, Access Request Manager.

Prerequisites

Before you begin, ensure the following prerequisites are met:

  • Create RDS Aurora DB with MySQL flavour with a database name. You'll need to use the database name in the Configuration section below.

    Note

    The RDS database name which you will be entering in the Configuration section below should be created in advance. Privacera does not create a RDS database, but only creates table schemas.

  • If you have installed Privacera using the internal Maria DB and wish to move from the internal database to an external MySQL DB, then you will have to delete the Maria DB container/pod. For more information, see Service Commands.

CLI configuration
  1. SSH to the instance where Privacera is installed.

  2. Run the following command.

    cd ~/privacera/privacera-manager
    cp config/sample-vars/vars.external.db.mysql.yml config/custom-vars/
    vi config/custom-vars/vars.external.db.mysql.yml
    
  3. In this file set values for the following:

    Set the following as False.

    DB_INSTALL_MARIADB: "false"
    

    Enter the hostname of the AWS MySQL server, and the name of the database you want to connect to. Get the name of the database from the Prerequisites section above.

    EXTERNAL_DB_HOST: "<PLEASE_CHANGE>"
    EXTERNAL_DB_NAME: "<PLEASE_CHANGE>"
    

    Enter the credentials of the user who has access to the database.

    EXTERNAL_DB_USER: "<PLEASE_CHANGE>"
    EXTERNAL_DB_PASSWORD: "<PLEASE_CHANGE>"
    

    (Optional) Enter a database name for Privacera Portal, Privacera Ranger, and Privacera Ranger KMS. It is recommended to provide different names for the 3 databases.

    PRIVACERA_PORTAL_DB_NAME: "{{EXTERNAL_DB_NAME}}"
    PRIVACERA_RANGER_DB_NAME: "{{EXTERNAL_DB_NAME}}"
    PRIVACERA_RANGER_KMS_DB_NAME: "{{EXTERNAL_DB_NAME}}"                              

    Save and Exit.

  4. Run the following command.

    cd ~/privacera/privacera-manager
    ./privacera-manager.sh update
    

Note

Make sure you're familiar with encryption for Aurora. See the Aurora documentation.

Azure PostgreSQL

This topic allows you to connect to an Azure PostgreSQL server from the Azure virtual machine which will act as a storage for Ranger database and Privacera database (Optional).

Prerequisites

Before you begin, ensure the following prerequisite are met:

  • Create a privacera_db database in the Azure PostgreSQL server that can be accessible.

CLI Configuration
  1. SSH to the instance where Privacera is installed.

  2. Run the following command.

    cd ~/privacera/privacera-manage
    cp config/sample-vars/vars.external.db.yml config/custom-vars/
    cp config/sample-vars/vars.external.db.postgres.yml config/custom-vars/
    vi config/custom-vars/vars.external.db.postgres.yml
    
  3. In this file set values for the following:

    Enter the hostname of the Azure PostgreSQL server, and the name of the database you want to connect to.

    EXTERNAL_DB_HOST: "<PLEASE_CHANGE>"
    EXTERNAL_DB_NAME: "privacera_db"
    

    Enter the credentials of the user who has access to the database.

    EXTERNAL_DB_USER: "<PLEASE_CHANGE>"
    EXTERNAL_DB_PASSWORD: "<PLEASE_CHANGE>"
    

    (Optional) Enter a database name for Privacera Portal, Privacera Ranger, and Privacera Ranger KMS. It is recommended to provide different names for the 3 databases.

    PRIVACERA_PORTAL_DB_NAME: "{{EXTERNAL_DB_NAME}}"
    PRIVACERA_RANGER_DB_NAME: "{{EXTERNAL_DB_NAME}}"
    PRIVACERA_RANGER_KMS_DB_NAME: "{{EXTERNAL_DB_NAME}}"
    
Validation
  1. Login to Privacera portal.

  2. Go to Access Management > Resource Policies. You should be able to see the Postgres service.

AuditServer

Configure Solr destination
Configure Solr destination

This topic covers how you can set up an AuditServer to receive audits from Privacera Plugins and Ranger Admin and send those audits to Solr and Fluentd. If you choose to keep the audits beyond a 90-day period, you can use AuditServer for that purpose.

By default, the Ranger plugin sends the audits to Solr, where the audits expire after a 90-day period. If you want to configure the audit log expiry period, see MAX_AUDIT_RETENTION_DAYS property in the Solr properties.

CLI configuration
  1. SSH to an instance where Privacera is installed.

  2. Run the following commands.

    cd ~/privacera/privacera-manager
    cp config/sample-vars/vars.auditserver.yml config/custom-vars/
    vi config/custom-vars/vars.auditserver.yml
    
  3. Edit the following properties. For property details and description, refer to the Configuration Properties below.

    AUDITSERVER_AUTH_TYPE: "<PLEASE_CHANGE>"
    AUDITSERVER_AUTH_USER: "<PLEASE_CHANGE>"
    AUDITSERVER_AUTH_PASSWORD: "<PLEASE_CHANGE>"
    AUDITSERVER_SOLR_DESTINATION: "<PLEASE_CHANGE>"
    ADMIN_AUDITSERVER_SOLR_DESTINATION: "<PLEASE_CHANGE>"
    
  4. Run the following commands.

    cd ~/privacera/privacera-manager
    ./privacera-manager.sh update
    

Related Information

For further reading, see Unable to view the audits

Configuration properties

The property names prefixed with ADMIN_ refer to Privacera Ranger Admin, whereas the others refer to Privacera Portal.

Property

Description

Example

AUDITSERVER_AUTH_TYPE

Set this property to enable basic authentication.

Value: None/Basic

basic

AUDITSERVER_AUTH_USER

AUDITSERVER_AUTH_PASSWORD

If the above authentication type is set to basic, assign a username and password. You can assign any user credentials.

Value: True/False

AUDITSERVER_AUTH_USER: "padmin"

AUDITSERVER_AUTH_PASSWORD: "padmin"

AUDITSERVER_SOLR_DESTINATION

ADMIN_AUDITSERVER_SOLR_DESTINATION

Set to true if the audit destination is Solr.

Configure Kafka destination

This topic covers how you can configure Kafka audit endpoint in AuditServer for the Ranger plugin and the Ranger Admin to send the audits.

Prerequisites

Ensure the following prerequisites are met:

  • AuditServer must be configured. For more information, click here.

CLI configuration
  1. SSH to an instance where Privacera is installed.

  2. Run the following commands.

    cd ~/privacera/privacera-manager
    cp config/sample-vars/vars.auditserver.kafka.destination.yml config/custom-vars/
    vi config/custom-vars/vars.auditserver.kafka.destination.yml
    
  3. Modify the properties. For property details and description, refer to the Configuration Properties below.

    AUDITSERVER_KAFKA_DESTINATION:"<PLEASE_CHANGE>"AUDITSERVER_KAFKA_BROKER_LIST:"<PLEASE_CHANGE>"AUDITSERVER_KAFKA_TOPIC_NAME:"<PLEASE_CHANGE>"AUDITSERVER_KAFKA_SECURITY_PROTOCOL:"<PLEASE_CHANGE>"AUDITSERVER_KAFKA_SSL_KEYSTORE_LOCATION:"<PLEASE_CHANGE>"AUDITSERVER_KAFKA_SSL_KEYSTORE_PASSWORD:"<PLEASE_CHANGE>"AUDITSERVER_KAFKA_SSL_KEY_PASSWORD:"<PLEASE_CHANGE>"AUDITSERVER_KAFKA_SSL_TRUSTSTORE_LOCATION:"<PLEASE_CHANGE>"AUDITSERVER_KAFKA_SSL_TRUSTSTORE_PASSWORD:"<PLEASE_CHANGE>"AUDITSERVER_KAFKA_SASL_JAAS_CONFIG:"<PLEASE_CHANGE>"AUDITSERVER_KAFKA_SASL_MECHANISM:"<PLEASE_CHANGE>"AUDITSERVER_KAFKA_SASL_LOGIN_CALLBACK_HANDLER_CLASS:"<PLEASE_CHANGE>"AUDITSERVER_KAFKA_OAUTH_TOKEN_ENDPOINT_URI:"<PLEASE_CHANGE>"AUDITSERVER_KAFKA_OAUTH_WITH_SSL:"<PLEASE_CHANGE>"AUDITSERVER_OAUTH_ACCEPT_UNSECURE_SERVER:"<PLEASE_CHANGE>"AUDITSERVER_OAUTH_LOGIN_GRANT_TYPE:"<PLEASE_CHANGE>"AUDITSERVER_KAFKA_OAUTH_CLIENT_ID:"<PLEASE_CHANGE>"AUDITSERVER_KAFKA_OAUTH_CLIENT_SECRET:"<PLEASE_CHANGE>"AUDITSERVER_KAFKA_BATCH_FILESPOOL_DIR:"/workdir/privacera-audit-server/kafka-spool"ADMIN_AUDITSERVER_KAFKA_DESTINATION:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_KAFKA_BROKER_LIST:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_KAFKA_TOPIC_NAME:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_KAFKA_SECURITY_PROTOCOL:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_KAFKA_SSL_KEYSTORE_LOCATION:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_KAFKA_SSL_KEYSTORE_PASSWORD:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_KAFKA_SSL_KEY_PASSWORD:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_KAFKA_SSL_TRUSTSTORE_LOCATION:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_KAFKA_SSL_TRUSTSTORE_PASSWORD:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_KAFKA_SASL_JAAS_CONFIG:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_KAFKA_SASL_MECHANISM:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_KAFKA_SASL_LOGIN_CALLBACK_HANDLER_CLASS:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_KAFKA_OAUTH_TOKEN_ENDPOINT_URI:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_KAFKA_OAUTH_WITH_SSL:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_OAUTH_ACCEPT_UNSECURE_SERVER:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_OAUTH_LOGIN_GRANT_TYPE:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_KAFKA_OAUTH_CLIENT_ID:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_KAFKA_OAUTH_CLIENT_SECRET:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_KAFKA_BATCH_FILESPOOL_DIR:"/workdir/privacera-audit-server/kafka-spool"
    
  4. Run the following commands.

    cd ~/privacera/privacera-manager
    ./privacera-manager.sh update
    
Configuration properties

The property names prefixed with ADMIN_ refer to Privacera Ranger Admin, whereas the others refer to Privacera Portal.

Property

Description

Example

AUDITSERVER_KAFKA_DESTINATION

ADMIN_AUDITSERVER_KAFKA_DESTINATION

Set to true if audit destination is kafka

AUDITSERVER_KAFKA_BROKER_LIST

ADMIN_AUDITSERVER_KAFKA_BROKER_LIST

A list of host/port pairs to use for establishing the initial connection to the Kafka cluster. This list should be in the form host1:port1,host2:port2,.... Since these servers are just used for the initial connection to discover the full cluster membership (which may change dynamically), this list need not contain the full set of servers (you may want more than one, though, in case a server is down).

10.xxx.xx.xxx:9093

AUDITSERVER_KAFKA_TOPIC_NAME

ADMIN_AUDITSERVER_KAFKA_TOPIC_NAME

Topic name to which audits are to be sent

topic-name

AUDITSERVER_KAFKA_SECURITY_PROTOCOL

ADMIN_AUDITSERVER_KAFKA_SECURITY_PROTOCOL

Protocol used to communicate with brokers.

Valid values are: PLAINTEXT, SSL, SASL_PLAINTEXT, SASL_SSL.

SASL_SSL

AUDITSERVER_KAFKA_SSL_KEYSTORE_LOCATION

ADMIN_AUDITSERVER_KAFKA_SSL_KEYSTORE_LOCATION

The location of the key store file.

Make sure key is copied in config/ssl folder. Provide name of the file.

kafka.server.keystore

AUDITSERVER_KAFKA_SSL_KEYSTORE_PASSWORD

ADMIN_AUDITSERVER_KAFKA_SSL_KEYSTORE_PASSWORD

The store password for the key store file.This is optional and only needed if AUDITSERVER_KAFKA_SSL_KEYSTORE_LOCATION is configured.

privacera

AUDITSERVER_KAFKA_SSL_KEY_PASSWORD

ADMIN_AUDITSERVER_KAFKA_SSL_KEY_PASSWORD

The password of the private key in the key store file. This is optional.

privacera

AUDITSERVER_KAFKA_SSL_TRUSTSTORE_LOCATION

ADMIN_AUDITSERVER_KAFKA_SSL_TRUSTSTORE_LOCATION

The location of the trust store file. Make sure the key is copied in config/ssl folder. Provide name of the file.

kafka.server.truststore

AUDITSERVER_KAFKA_SSL_TRUSTSTORE_PASSWORD

ADMIN_AUDITSERVER_KAFKA_SSL_TRUSTSTORE_PASSWORD

The password for the trust store file.

privacera

AUDITSERVER_KAFKA_SASL_JAAS_CONFIG

ADMIN_AUDITSERVER_KAFKA_SASL_JAAS_CONFIG

Kafka uses the Java Authentication and Authorization Service (JAAS) for SASL configuration. You must provide JAAS configurations for all SASL authentication mechanisms.

E.g "org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required ;" if AUDITSERVER_KAFKA_SASL_MECHANISM is "OAUTHBEARER

org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required ;

AUDITSERVER_KAFKA_SASL_MECHANISM

ADMIN_AUDITSERVER_KAFKA_SASL_MECHANISM

SASL mechanism used for connections. This may be any mechanism for which a security provider is available. GSSAPI is the default mechanism.

OAUTHBEARER

AUDITSERVER_KAFKA_SASL_LOGIN_CALLBACK_HANDLER_CLASS

ADMIN_AUDITSERVER_KAFKA_SASL_LOGIN_CALLBACK_HANDLER_CLASS

The LoginModule for the selected SASL_MECHANISM

E.g "io.strimzi.kafka.oauth.client.JaasClientOauthLoginCallbackHandler" if AUDITSERVER_KAFKA_SASL_MECHANISM is "OAUTHBEARER

io.strimzi.kafka.oauth.client.JaasClientOauthLoginCallbackHandler

AUDITSERVER_KAFKA_OAUTH_TOKEN_ENDPOINT_URI

ADMIN_AUDITSERVER_KAFKA_OAUTH_TOKEN_ENDPOINT_URI

OAUTH Token endpoint URL used by the application in order to get an access token or a refresh token

http://10.211.93.140:4444/oauth2/token

AUDITSERVER_KAFKA_OAUTH_WITH_SSL

ADMIN_AUDITSERVER_KAFKA_OAUTH_WITH_SSL

Set to true if SSL is applied on OAUTH.

AUDITSERVER_OAUTH_ACCEPT_UNSECURE_SERVER

ADMIN_AUDITSERVER_OAUTH_ACCEPT_UNSECURE_SERVER

Set to true if OAUTH accept unsecure server.

AUDITSERVER_OAUTH_LOGIN_GRANT_TYPE

ADMIN_AUDITSERVER_OAUTH_LOGIN_GRANT_TYPE

The authorization server needs to know which grant type the application wants to use since it affects the kind of credential it will issue

e.g client_credentials

client_credentials

AUDITSERVER_KAFKA_OAUTH_CLIENT_ID

ADMIN_AUDITSERVER_KAFKA_OAUTH_CLIENT_ID

The ID of the application that asks for authorization.

broker-kafka

AUDITSERVER_KAFKA_OAUTH_CLIENT_SECRET

ADMIN_AUDITSERVER_KAFKA_OAUTH_CLIENT_SECRET

The secret of the application that asks for authorization.

broker-kafka

AUDITSERVER_KAFKA_BATCH_FILESPOOL_DIR

ADMIN_AUDITSERVER_KAFKA_BATCH_FILESPOOL_DIR

If audit framework detects that an audit destination is down then it buffers the audit messages in memory. Once memory buffer fills up then it can be configured to spool the unsent messages to disk files to prevent or minimize the loss of audit messages. Local disk directory where spool files would be kept. This value must be specified.

Default location is "/workdir/privacera-audit-server/kafka-spool

/workdir/privacera-audit-server/kafka-spool

Solr authentication

This topic covers how to handle basic Solr authentication for servers and clients.

CLI configuration
  1. SSH to the instance where Privacera is installed.

  2. Run the following commands.

    cd ~/privacera/privacera-manager
    cp config/sample-vars/vars.solr.yml config/custom-vars/
    vi config/custom-vars/vars.solr.yml
    
  3. Modify the properties below. For property details and description, refer to the Configuration Properties below.

    SOLR_BASIC_AUTH_ENABLED: <PLEASE_CHANGE>
    SOLR_BASIC_AUTH_USER: <PLEASE_CHANGE>
    SOLR_BASIC_AUTH_PASSWORD: <PLEASE_CHANGE>
    

    Note

    You can also add custom properties that are not included by default. See Solr.

  4. Run the following commands.

    cd ~/privacera/privacera-manager
    ./privacera-manager.sh update
    
Configuration properties

Property

Description

SOLR_BASIC_AUTH_ENABLED

Set this property to true to enable the basic authentication.

SOLR_BASIC_AUTH_USER

SOLR_BASIC_AUTH_PASSWORD

Assign the user credentials for the Solr authentication.

Zookeeper

Restrict access in Kubernetes

This topic covers how you can restrict access to a Zookeeper pod in a Kubernetes environment.

You can enable/disable a range of source IPs that can access a Zookeeper pod.

Configuration
  1. Create vars.zk-access.yml file.

    cd ~/privacera/privacera-manager
    vi config/custom-vars/vars.zk-access.yml
  2. Add the following property, and enter the correct network CIDR Address. For example, 172.20.0.0/16.

    ZOOKEEPER_K8S_NETWORKING_LOADBALANCER_SOURCE_RANGES:-"<PLEASE_UPDATE>"
  3. Run the following command.

    cd ~/privacera/privacera-manager
    ./privacera-manager.sh update