Release 9.2.35.1¶

Runtime Plane improvements for Apache Ranger¶

Added cgroup-aware JVM tuning, unified logging configuration, runtime.properties overrides, and improved audit/Solr configuration handling for Runtime Plane deployments.

Fixed UserSync Group Membership Not Saved When Metadata-Service (OMNI) Integration Is Enabled¶

Fixed an issue where, with Metadata-Service (OMNI) integration enabled, group membership updates from UserSync were rejected by the Metadata-Service because the request did not include the required source field, so the membership was not saved in either the Metadata-Service or Ranger. Group membership sync now sets source correctly and completes successfully.

Runtime Plane improvements for Audit Server¶

Added cgroup-aware JVM sizing, ZGC defaults, improved logging configuration, and container startup resilience for Runtime Plane deployments.

Updated Apache Solr Dependencies¶

Upgraded Apache Solr dependencies to address known security vulnerabilities identified in the CVE (Common Vulnerabilities and Exposures) report.

Updated Apache Zookeeper Dependencies¶

Upgraded Apache Zookeeper dependencies to address known security vulnerabilities identified in the CVE (Common Vulnerabilities and Exposures) report.

Audit Fluentd Base Image Upgraded¶

Updated the Audit Fluentd base image to a newer Debian version to address known security vulnerabilities identified in the Common Vulnerabilities and Exposures (CVE) report.

Updated DataServer Dependencies¶

Upgraded DataServer dependencies to address known security vulnerabilities identified in the CVE (Common Vulnerabilities and Exposures) report.

DataServer Base Image Upgraded¶

Updated the DataServer base image to a newer Debian version to address known security vulnerabilities identified in the CVE report.

Omni Metadata Service Base Image Upgraded¶

Updated the Omni Metadata Service base image to a newer Debian version to address known security vulnerabilities identified in the CVE report.

Updated PEG Dependencies¶

Upgraded PEG dependencies to address known security vulnerabilities identified in the CVE report.

PEG Base Image Upgraded¶

Updated the PEG base image to a newer Debian version to address known security vulnerabilities identified in the CVE report.

Lake Formation — Fixed Federated Catalog Resources Not Visible in Service Explorer¶

Fixed an issue where the region, databases, and tables under an AWS Lake Formation federated catalog were not visible in the Service Explorer. Federated catalogs now display their full resource hierarchy.

Scoped Table Load for On-Demand Sync of Foreign Catalogs in Databricks Unity Catalog Connector¶

Added support to skip loading child tables for Foreign Catalogs during catalog- and schema-scoped on-demand syncs when the request does not include a table key, improving performance for large catalogs and schemas.

Snowflake — Fixed On-Demand Resource Sync for Mixed-Case Identifiers¶

Fixed an issue where the Snowflake connector failed to load mixed-case resources during on-demand resource synchronization because identifiers were used unquoted in metadata queries. Resource-loading queries now quote identifiers across all resources so these objects and their children are discovered and policies can be applied.

Snowflake — Fixed NullPointerException When a Policy References a Missing Principal¶

Fixed a NullPointerException in the policy engine that occurred during masking policy evaluation when a role referenced in a policy was missing from the principal store while processing RANGER_PRINCIPALS change logs. The policy engine now validates each principal returned from the store before use. If a user, group, or role referenced in a policy is missing from the store, that principal is skipped (with a DEBUG log entry, for example dataMask(...): skipped evaluation for missing role <name>) and evaluation continues for the remaining principals.

Snowflake — Principal Directory for Membership- and Attribute-Based Policies¶

Added an opt-in principal directory for the Snowflake connector. When enabled, masking and row-filter policies whose conditions reference principal membership or attributes (for example IS_IN_GROUP, HAS_USER_ATTR, or USER.<attr> comparisons) are emitted as a constant-size EXISTS sub-query against a connector-owned directory table instead of inlining the resolved list of users. This keeps the generated policy SQL small, avoids regenerating it whenever membership changes, and prevents large groups or roles from exceeding Snowflake statement-size limits. Enable it with CONNECTOR_SNOWFLAKE_ENABLE_PRINCIPAL_DIRECTORY (disabled by default). For more information, see Configure Principal Directory.

Snowflake — Automate User-to-Role Mapping in Snowflake via Privacera¶

The Snowflake connector now supports granting Privacera-managed group and role shadow roles (PRIV_GROUP_* / PRIV_ROLE_*) directly to Snowflake users. This eliminates per-user PRIV_USER_* shadow roles and greatly reduces the number of roles created in Snowflake.

• This is opt-in. Enable it using ranger.policysync.connector.snowflake.grant.group.role.directly.to.user (default false).
• When enabled, group and role membership is synced with GRANT ROLE ... TO USER / REVOKE ROLE ... FROM USER statements. Enabling it on an existing setup automatically cleans up legacy PRIV_USER_* roles and re-grants current members directly.
• Limitations: user-level policies (resource access, tag ACLs, and user-only masking or row-filter policies) are not applied and fail closed. Masking and row-filter conditions that use USER.*, GET_USER_ATTR, or HAS_USER_ATTR are not supported — use group- or role-based policies instead.

Send On-Demand Sync Audits to Amazon S3, Amazon SQS, and Amazon SNS¶

• For Lake Formation, Databricks Unity Catalog, and Databricks SQL Analytics connectors, audits for on-demand resource syncs can now be sent to Amazon S3, Amazon SQS, and Amazon SNS, in addition to Apache Solr. They use the same audit destinations you already configure for connector audits, so there is no new destination setup.
• This is opt-in. Enable it using CONNECTOR_ON_DEMAND_AUDIT_ENABLE. When it is on, an on-demand sync sends these per-resource events instead of the single LOADER event; scheduled syncs are not affected. For more information, see Send on-demand sync audits to S3, SQS, or SNS.

Updated PolicySync Dependencies¶

Upgraded PolicySync dependencies to address known security vulnerabilities identified in the CVE (Common Vulnerabilities and Exposures) report.

Updated Connectors:

• Databricks Unity Catalog
• Snowflake

PolicySync Base Image Upgraded¶

Updated the PolicySync base image to a newer Debian version to address known security vulnerabilities identified in the CVE report.

Updated Connectors:

• Databricks Unity Catalog
• Snowflake

OMNI Tag Enricher: Deterministic Callback Deregistration¶

Fixed a memory leak where OMNI tag-enricher callback registrations were not reliably released on Ranger policy-engine refresh, gradually increasing memory usage until an eventual restart. Deregistration now happens on every refresh cycle, and a configurable warning threshold flags abnormal registration growth early.

Updated Portal Dependencies and Base Image¶

Upgraded Portal dependencies and updated the base image to a newer version to address known security vulnerabilities identified in the CVE (Common Vulnerabilities and Exposures) report.

Security Fixes for Diagnostics Client and Server¶

Remediated Critical/High CVEs (Common Vulnerabilities and Exposures) via base image and Python dependency upgrades. No functional changes.

Diagnostics: Connector Test Case Fixes¶

Fixed Diagnostics Client connector test failures for Snowflake, Databricks Unity Catalog, and MSSQL.

Diagnostics Server Runtime Config Client Integration¶

Integrated the config-client-python library in the Diagnostics Server to enable config updates via the runtime UI.

Diagnostics Server — Database-backed Error Log Download¶

Added support to download error logs from the Diagnostics database after pod rotation or termination.

Fixed Test Result PDF Download¶

Fixed Diagnostics Server test-result PDF download failing with HTTP 500 when failure messages were very long. The PDF shows only the first exception; the full stack remains in Diagnostics Server.

Updated Discovery Dependencies¶

Upgraded Discovery dependencies to address known security vulnerabilities identified in the CVE (Common Vulnerabilities and Exposures) report.

Base Image Upgraded¶

Updated the base image to a newer Debian version to address known security vulnerabilities identified in the CVE (Common Vulnerabilities and Exposures) report.

Updated Grafana Image¶

Upgraded Grafana dependencies to address known security vulnerabilities identified in the CVE (Common Vulnerabilities and Exposures) report.

Updated Prometheus Image¶

Upgraded Prometheus dependencies to address known security vulnerabilities identified in the CVE (Common Vulnerabilities and Exposures) report.

Updated Metrics Annotation Job Image¶

Upgraded Metrics Annotation Job dependencies to address known security vulnerabilities identified in the CVE (Common Vulnerabilities and Exposures) report.

Updated Opentelemetry-collector Image¶

Upgraded Opentelemetry-collector dependencies to address known security vulnerabilities identified in the CVE (Common Vulnerabilities and Exposures) report.

Updated Post Install Job Image¶

Upgraded Post Install Job dependencies to address known security vulnerabilities identified in the CVE (Common Vulnerabilities and Exposures) report.

Updated Privacera PKafka Application Dependencies¶

Upgraded application dependencies to address known security vulnerabilities identified in the CVE (Common Vulnerabilities and Exposures) report.

Improved SCIM Server Performance¶

SCIM Server group PATCH responses now exclude the group members list, improving performance for large group updates.

Self-Managed Deployment Support for AWS Cloud¶

Runtime Planes now support Self-Managed deployment for AWS Cloud as well. The following connectors are supported, with more connectors planned in future releases:

• Microsoft SQL Server
• Databricks Unity Catalog
• Snowflake
• GCP BigQuery
• Databricks SQL Analytics
• AWS Lake Formation
• Amazon Redshift