Release 9.2.37.1¶

Ranger Database Cleanup for Runtime Plane¶

Added automated backup and cleanup of old Ranger database records from the x_auth_sess and x_trx_log tables, with configurable retention, schedule, and backup destination, for Self-Managed Runtime Planes. For more information, see Configure Ranger Database Cleanup.

Data masking and row-level filter policies — wildcard support¶

Masking and row-level filter policy resources can now use wildcard (*) matching, which is consistent with access policy behavior.

Zone-scoped policy and metrics visibility for Zone Admins and Zone Auditors¶

Zone Admins and Zone Auditors can now list and count policies in their authorized security zones. Dashboard policy metrics follow the same zone scope. Global admins and Ranger Auditors continue to see policies and dashboard metrics across all zones.

Behavioral change: Soft-deleted resources retain tag mappings for 15 days¶

When a resource is deleted and later recreated — for example, through CREATE OR REPLACE VIEW — Metadata-Service now soft-deletes the resource instead of removing it immediately. Its tag mappings are retained for 15 days by default (configurable TTL) and are restored automatically when the resource reappears on re-sync. Child resources are handled recursively. After the retention period, a scheduled cleanup permanently removes the resource and its tag mappings.

• What you may notice: If you delete a resource, recreate it, and then re-apply the same tags through the API or UI, those tags may already be present from the restored resource. A tag-mapping API call can return a conflict or already-exists error instead of creating a duplicate mapping.
• What to do: Before re-applying tags after a delete-and-recreate, check whether the restored resource already carries the expected tag mappings. No action is needed if you do not re-apply tags programmatically after recreating resources.

Resource Sync Succeeds for Names Containing Special Characters¶

Resource create, patch, and delete requests to Omni Metadata Service failed with a 400 error when a database, schema, table, or column name contained a special character such as /. These names are now stored and looked up as a single path segment, so create, patch (including tag and policy updates), and delete succeed for names that are valid at the data source.

Data Governance: Resource Attributes & Resource Linking¶

Added support for persisting and exposing resource-level attributes (key-value metadata) and resource links. Sync now detects attribute-only changes, creates RESOURCE_LINK relationships, and exposes linked resource information through APIs.

Updated Metadata-Service Dependencies¶

Upgraded Metadata-Service dependencies to address known security vulnerabilities identified in the CVE (Common Vulnerabilities and Exposures) report.

Fixed Access Audits Failing with Unknown Host for Audit Server¶

Fixed an issue where PolicySync connectors on PrivaceraCloud failed to publish access audits because the Audit Server destination URL still pointed at the unresolved placeholder host auditserver. Helm now wires auditserver.urls from RANGER_AUDIT_SERVER_URL (same resolved Audit Server endpoint used for other audit destinations), so access audits are delivered successfully.

Databricks Unity Catalog Connector — Improved Failure Reporting and Audit Policy Details¶

• Improved Resource Sync Failure Reporting: Resource sync task failures now report the specific failed resource, Databricks error code and SQL state, and underlying cause instead of a generic Exception.
• Improved Grant Failure Reason Reporting: POLICY_RESPONSE events now capture the specific error or exception in policy sync audits, replacing the generic unspecified failure reason.
• Policy Details Populated for Multi-Permission Policies: Fixed missing policy details (policy ID, version, name) on ACCESS audit/changelog events for policies that grant multiple permissions, including implicit grants such as USE CATALOG and USE SCHEMA.

Databricks SQL Analytics Connector — Improved Failure Reporting and Audit Policy Details¶

• Improved Resource Sync Failure Reporting: Resource sync task failures now report the specific failed resource, Databricks error code and SQL state, and underlying cause instead of a generic Exception.
• Improved Grant Failure Reason Reporting: POLICY_RESPONSE events now capture the specific error or exception in policy sync audits, replacing the generic unspecified failure reason.
• Policy Details Populated on Role-Grant Audit Events: Fixed a gap where ACCESS audit/changelog events for grants to roles were missing policy details (policy ID, version, name, and type). Role grants now carry the same policy metadata as user and group grants.

Lake Formation Connector — Improved Resource Sync Failure Reporting¶

• Resource sync task failures now report the specific failed resource, AWS error code, and underlying cause instead of a generic Exception.

PolicySync Base — Ranger-aligned Hadoop client (JDK 24+)¶

PolicySync Base no longer ships its own unshaded Hadoop jars. It uses Ranger’s shaded Hadoop client so a single JDK 24+–compatible Hadoop stack is on the classpath. This addresses Subject.getSubject / RangerCredentialProvider failures and avoids Jersey collisions with Ranger. Transitive libraries that previously came in via Hadoop are now pinned directly in base.

Updated PolicySync Dependencies¶

Upgraded PolicySync dependencies to address known security vulnerabilities identified in the CVE (Common Vulnerabilities and Exposures) report.

Updated Connectors:

• Databricks SQL Analytics
• Redshift

PolicySync Base Image Upgraded¶

Updated the PolicySync base image to a newer Debian version to address known security vulnerabilities identified in the CVE report.

Updated Connectors:

• Databricks SQL Analytics
• Redshift

SSO Role Mapping Support for Existing Users¶

SSO role mapping attributes are now applied to existing users when they sign in through SSO. Previously, role mappings were applied only when a new user was created.

Updated Dashboard Access for ROLE_USER¶

Users with the ROLE_USER role are now redirected to the Dashboard after login. The Dashboard content is displayed based on whether Omni metadata is enabled.

SCIM Server, Support fo Exclude Group Members on GET by ID¶

SCIM Server now supports the excludedAttributes=members query parameter on GET Group by ID. Omitting the members list reduces response size and improves performance for large groups.

SCIM Server, Improved Search by Object Name¶

Improved performance of SCIM Server GET requests for /Users and /Groups when filtering on object name.