Skip to main content

Privacera Platform

Table of Contents

Dremio user guide

:

This user guide describes how to validate access control on Dremio data sources. For more information about Dremio installation, see Dremio Plugin.

Note

The Privacera Plugin uses the privacera_dremio repository for access control.

Prerequisites

  • A Privacera Manager host with Privacera services running.

  • A Dremio host with Dremio Enterprise Edition installed. (The Community Edition is not supported.)

  • A data lake. Supported data lakes include:: 

    • s3

    • ADLS

    • Hive

    • Redshift

Dremio Ranger Based authorization

Dremio Ranger Based authorization is a Hive authorization client that checks your Ranger policy permissions and then allows or disallows access as defined by the Ranger policy. Connecting Dremio Ranger Based Hive authorization with Privacera’s Ranger-based data access governance extends Apache Ranger’s open source capabilities to take advantage of Privacera’s centralized enterprise-ready solution.

Install and set up the Privacera Dremio plugin.

To configure the Dremio Hive source:

  1. Dremio dashboard home page in the Data Lakes section: click the Add Data Lake / Plus icon to add the source.

  2. Select Hive 2.x or Hive 3.x from Table Stores.

  3. Enter your Hive source Name, Hive Metastore Host, and Port Number.

  4. In Authorization > Client enter the following information:

    • Ranger Based Authorization

    • Ranger Service name: privacera_hive

    • Enter the Ranger Host URL:

      • Platform: https://ranger-plugin-my-eks.mydomain.com

      • Cloud: https://privacera.com/api/api-key.

Continue with advanced options

  1. Uncheck Enable external authorization plugin.

    Unchecking the box will use Ranger Base Authorization

    Checking the box will use the Privacera Dremio plugin

  2. Add the following Connection Properties for SSL and Audit server configuration:

    Property

    Description

    Example

    ranger.plugin.hive.policy.rest.ssl.config.file

    Path of ranger SSL cofig ranger-policymgr-ssl.xml file

    /opt/privacera/conf/ranger-policymgr-ssl.xml

    xasecure.audit.is.enabled

    To enable auditing set to true.

    true

    xasecure.audit.destination.solr

    To use SOLR as auditing using server set to true.

    true

    xasecure.audit.destination.solr.urls

    URL of SOLR audit server

    Platform:https://auditserver-plugin-mydomain.com/solr/ranger_audits

    PCloud: https://privacera.com/api/<api-key>/solr/ranger_audits

    See API Key

    xasecure.audit.destination.hdfs

    To use HDFS as an auditing service.

    false

    xasecure.audit.destination.file.dir

    Audit directory for HDFS

    ranger/audit/file

    xasecure.audit.destination.solr.batch.filespool.dir

    Audit directory for SOLR

    ranger/audit/solr/spool

    xasecure.audit.provider.summary.enabled

    To enable summarization set to true

    true

  3. In Metadata > Authorization > Expire after set the authorization.

  4. Choose Save.

Run a sample query

Note

The Privacera Plugin for Dremio supports access control only for SELECT queries on tables.

To select data in a table:

  1. Run the following command: select*fromtest_catalog.test_db.test_table

    In Privacera Portal, when you check Access Manager > Audits, access will be denied.

  2. In Privacera Portal, create an access policy in Access Management > Resource Policies > privacera_dremio for the table and grant Select permissions:

  3. Run the query again.

    You will see that access has been granted.