Release 9.2.45.1¶

Template UDFs for Row-Level Filtering¶

Added a new Template UDF type that lets many row-filter policies share one filter definition. A template declares column parameters and named conditions. Each row-filter policy item references the template by name, picks a condition, and maps the table's columns to the template's parameters. While policies use a template, its name and parameters can't be changed, and invalid templates or policies are rejected with a specific error code. The Java client supports Template UDFs.

Security Updates for Apache Ranger Dependencies¶

Upgraded vulnerable dependencies in Apache Ranger, including Jackson, Jetty, Log4j, HttpClient, LZ4, JLine and ZooKeeper. Container scans confirm that the known CVEs (Common Vulnerabilities and Exposures) in these dependencies are resolved. There are no functional changes.

Search Users by Name or First Name¶

User search now supports firstName (partial match) and nameOrFirstName (matches either user name or first name) filters.

Exclude Built-in Accounts from User Search¶

nosysadmins=true now works on the user search API, matching existing /lookup/users behavior.

DataServer and Plugins with Omni Support on Runtime Plane¶

DataServer and plugins now support Omni on the Runtime Plane, and you can set them up and manage them through Runtime Manager. This is available in Runtime Plane-based Self-Managed and D2P deployments.

Supported components: DataServer, Databricks Clusters FGAC, Apache Spark OLAC, Trino and Starburst Trino.

• Simplified setup in the Runtime UI: configure DataServer and plugins through a simplified UI flow in Runtime Manager, with settings organized into clear categories.
• Multiple DataServer instances: deploy more than one DataServer instance on the same Runtime Plane.
• Downloadable install bundle: download a cluster install bundle from Runtime Manager to set up your clusters.

[Self-Managed only] New Connectors for GCP Cloud SQL MySQL and GCP Cloud SQL PostgreSQL¶

Discovery now supports Google Cloud SQL for MySQL and Google Cloud SQL for PostgreSQL with two new connectors, GCP Cloud SQL MySQL and GCP Cloud SQL PostgreSQL. The connectors use IAM database authentication, so no database password is stored in Privacera. For more information, see GCP Cloud SQL MySQL and GCP Cloud SQL PostgreSQL.

Control File Download from Data Explorer¶

Administrators can now stop users from downloading the original file of an Amazon S3, Google Cloud Storage or Azure ADLS object from the Portal. When the new System Configuration property Enable Data Explorer File Download (privacera.portal.ui.feature.data.explorer.download.enabled) is turned off, the Download button is hidden on Resource Detail (opened from Data Explorer and the Alerts Dashboard) and in the Health Check file list, and download requests to the Portal API are refused with HTTP 403. Users can still see tags, classifications and sample values, and a preview of the first 10 KB of the file. File Explorer is not affected. The property is turned on by default, so existing behavior does not change. For more information, see Control File Download from Data Explorer.

Schedule Data Zone Re-evaluation¶

Discovery can now re-evaluate a data source's data zones on a schedule, so files that were tagged but not moved or copied by a workflow policy are picked up without selecting Re-evaluate by hand. Amazon S3, Google Cloud Storage and Azure ADLS data sources have a new application property, Periodic Datazone Re-evaluation Interval (Minutes, 0 = Off) (datazone.reevaluate.schedule.interval.minutes). Set it to N to re-evaluate the data source's data zones that have a workflow policy every N minutes. Only files that Discovery has already scanned are processed, and alerts are not duplicated. The default is 0 (off), so existing behavior does not change. For more information, see Schedule Data Zone Re-evaluation.

[Self-Managed only] Portal Diagnostics Can Connect to Solr Again¶

Fixed an issue where, from release 9.2.41.1, the Portal on some nodes could not connect to Solr and Diagnostics showed "Not able to connect Solr". The Portal image contained Solr client libraries from two different versions. It now contains only one.

Omni Connector for Databricks, Snowflake, Amazon Redshift and AWS Lake Formation¶

Trust3 AI now includes the Omni Connector, a new connector for discovering metadata and governing access across your data platforms. It is designed for efficient syncing and reliable policy enforcement. It is available in Runtime Plane-based Self-Managed and D2P deployments.

Supported platforms: Databricks Unity Catalog, Databricks SQL, Snowflake, Amazon Redshift and AWS Lake Formation.

• Efficient metadata discovery: after the first scan, Trust3 AI retrieves full details only for new or changed objects, so scans transfer and process less data. Objects that are dropped or re-created are detected and reflected in the inventory.
• Reliable access enforcement: Trust3 AI translates your policies into each platform's native grants and applies only what has changed. If an operation fails, the next sync corrects it automatically. Related grants are batched to reduce the number of calls made to the platform.
• Permission drift visibility: Trust3 AI compares the grants that actually exist on the platform with the policies you defined in Trust3 AI and shows missing or unmanaged access. This check is read-only and does not change permissions.
• Flexible deployment: run the connector in a shared deployment, where one pod hosts multiple connector instances, or in a dedicated deployment.
• Resilient operation: the connector keeps local state, so it recovers cleanly from restarts and short interruptions.

Databricks Unity Catalog: Service Principals Identified by Display Name¶

Databricks Service Principals can now be identified by name. When enabled, Privacera shows a Service Principal's display name alongside its Application ID, as Finance User (7f96179e-68f9-4fe6-ba19-1916ed1e7d6c), when selecting users during Resource Policy creation, in the User column of Access Audits, and in the Actor column of PolicySync Audits. Both values remain searchable. This is display only: policies are authored and enforced on the Application ID, and PolicySync grants and revokes in Unity Catalog are unchanged. Turned off by default; enable it with PORTAL_UC_PRINCIPAL_NAME_RESOLUTION_ENABLE in Privacera Manager.

Databricks Unity Catalog: Parallel Grant Updates and Optional Skip of Implicit USE Grants¶

The Databricks Unity Catalog connector can now apply GRANT and REVOKE statements in parallel, so large policy changes apply much faster. It can also skip the implicit USE CATALOG and USE SCHEMA grants where public USE policies already cover the catalog and schema. GRANT/REVOKE and DESCRIBE statements now have their own timeouts. Both features are off by default, so existing behavior does not change. They are controlled by these new properties:

• CONNECTOR_DATABRICKS_UNITY_CATALOG_ENABLE_PARALLEL_GRANT_UPDATES (default false)
• CONNECTOR_DATABRICKS_UNITY_CATALOG_PARALLEL_GRANT_UPDATES_THREAD_COUNT (default 16)
• CONNECTOR_DATABRICKS_UNITY_CATALOG_PARALLEL_GRANT_UPDATES_MAX_INFLIGHT_PER_RESOURCE (default 16)
• CONNECTOR_DATABRICKS_UNITY_CATALOG_SKIP_IMPLICIT_USAGE_GRANTS (default false)
• CONNECTOR_DATABRICKS_UNITY_CATALOG_JDBC_MAX_POOL_SIZE

Databricks SQL Analytics: Databricks Statement ID on Access Events¶

The Databricks SQL Analytics connector now records the Databricks statement ID, shown as the Request ID in the Databricks query profile, on grant and revoke access events, along with connection, execution and round-trip timings.

MSSQL: Database Connection Retries Now Wait at Most 24 Hours¶

Fixed an issue where the MSSQL connector could stop reconnecting to a database for days after a connection failure. The wait between connection attempts doubled after every failed retry with no upper limit, so it could grow to almost 3 days and then to almost 6 days, and the connector appeared to have stopped retrying. The connector now keeps retrying and reconnects once the database is reachable again.

MSSQL: Upgraded SQL Server JDBC Driver to 12.8.2¶

Upgraded the SQL Server JDBC driver used by the MSSQL connector from 12.4.2 to 12.8.2. This fixes a driver error that could stop the connector from syncing after a database disconnect, and addresses CVE-2025-59250.

Create Template UDFs in the Portal¶

On the User-Defined Functions page, you can now create Template user-defined functions with parameters and condition names. To use one in a row-level filter policy, select a condition and bind the table's columns to the function's parameters. For how Template UDFs work in Apache Ranger, see Template UDFs for Row-Level Filtering under Apache Ranger.

Confirmation Before Removing a Service from a Security Zone¶

Removing a service from a Security Zone now shows how many of its policies will be deleted and asks you to confirm. The policies are deleted only when you save the zone.

Fixed Accepting and Rejecting Tags¶

Fixed an issue where manually accepting or rejecting a tag on a resource failed with an error.

Per-connector API keys for Databricks and Apache Spark connectors¶

Each Databricks and Apache Spark connector on a Self-Managed plane now gets its own runtime plugin API key, so revoking or rotating one connector's key no longer affects the others.

Ranger repositories are created automatically when you configure a plugin¶

Configuring a plugin from the Runtime UI now creates the Privacera Ranger repositories it needs. You no longer have to create them by hand before the plugin can enforce policies.

See an app's default Basic Auth credentials next to its link¶

The Portal now shows the default Basic Auth username and password beneath an application's UI link, so you can open a newly created app without looking the credentials up elsewhere.

Saving an app's configuration no longer restarts it unnecessarily¶

The first configuration save after creating an application no longer triggers a pod restart when nothing has actually changed.