Release 9.2.47.1¶

Faster Entitlement Reports and Role-Filtered Policy Search¶

Entitlement reports, entitlement counts and role-filtered policy search are much faster on tenants with many roles and policies. Large entitlement reports no longer time out or run Ranger Admin out of memory. Role cycles and deleted roles no longer cause these requests to fail. The entitlement report also stops listing users under policies that don't grant them access.

Broker Performance Improvement¶

Improved broker performance by retrying only the access changes that failed, instead of re-processing the whole batch of recent changes.

Fixed Data Product Creation with an API Key or by Non-Admin Users¶

Fixed an issue where creating a data product with an API key, or as a user who is not a Ranger admin, failed and the data product was rolled back.

Security Zones: Select All Databases, Catalogs or the Root Resource with *¶

When you add resources to a security zone, you can now select all databases, all catalogs or the root resource with *, instead of adding each one.

Tag Attributes Shown in Full in the Resource Tag List¶

Fixed an issue where the tag list of a resource split a tag's attributes across rows and pages, so the full set was never shown. Each tag now appears on one row with all of its attributes, the same as in tag search.

Trino: More Resource and Access Types in Access Policies¶

The Metadata Service now supports 6 more Trino resource types, such as data product domains, and 8 more access types, matching the Trino service definition in Apache Ranger. Access policies that use them no longer fail with an unsupported resource type error.

Added REFRESH TABLE Support for Hive / Parquet Tables¶

• Fixed an issue where REFRESH TABLE on Hive / Parquet tables was blocked with an AccessControlException when deny-by-default was enabled on Databricks FGAC clusters. REFRESH TABLE on these tables is now supported and checked against Ranger policies.

Group-Based Policies Now Apply to Databricks FGAC Clusters on Partially Managed (D2P) Runtime Planes¶

Fixed an issue where policies assigned to groups were not enforced for Databricks Fine-Grained Access Control (FGAC) clusters on Partially Managed (D2P) runtime planes. Members of a granted group were denied access, while policies assigned to users or roles worked as expected. Access, masking and row-level filter policies are now all enforced for groups.

Fixed Column Access Loss When Updating Policies with Active Row Filters in Lake Formation Connector¶

Fixed an issue in the Lake Formation connector where updating a column-level access policy on a table with an active row-level filter revoked access to all columns. Row-filter changes are now applied in a consistent revoke, drop, create, and grant order so access is preserved.

Databricks Unity Catalog – Catalog-Scoped Resource Loading¶

Fixed an issue where managing the system catalog caused repeated grant failures and unnecessary SQL warehouse load.

• Restricted resource loading to schemas and tables that actually belong to the system catalog, preventing policies from generating invalid GRANT statements for objects in other catalogs.
• Limited the connector's own grants on system to supported privileges: USE CATALOG, USE SCHEMA, SELECT, and MANAGE.

This prevents recurring grant failures on every sync and reduces unnecessary SQL warehouse load.

Snowflake: Masking and Row-Filter Fixes with Principal Directory¶

Implemented Principal Directory enhancements for conditional masking, row-filter policies, unmanaged user filtering, and multiple row-filter handling. Improved masking policy synchronization performance using the Principal Directory.

Snowflake: Custom Masks and Row Filters¶

Custom masks and row filters that use if in filter expression IFF(...) are now supported.

Policy Editor Stays Responsive on Policies with Thousands of Permission Items¶

The resource policy editor no longer freezes on policies with thousands of permission items. Permission blocks with more than 100 items are now paged in both the editor and the Policy Details preview. The editor also adds search by user, group or role, and a permission filter, so admins can find and update a specific grant quickly.

[PrivaceraCloud only] Improved Error Handling¶

Error messages in the portal are now clear and consistent, and no longer show internal system details. When something goes wrong, the message includes a Request ID you can give Trust3 AI Support for faster troubleshooting.

[PrivaceraCloud only] Internal Monitoring Endpoints Are No Longer Exposed¶

The portal no longer serves its internal application monitoring endpoints over the web, and it no longer forwards requests to the monitoring endpoints of connected services. These endpoints are not used by any portal feature, so nothing changes for users.

[Self-Managed only] Data Governance Shown by Default on Runtime Plane Setups¶

Self-Managed planes set up through a runtime plane now show Data Governance (Data Catalog, Tags, Products and the related pages) by default when the Omni Metadata Service is deployed. Previously these pages were hidden.

Helm Chart: Fixed Connector Rollouts Stuck in Pending¶

Fixed an issue where connector rollouts could get stuck in Pending when the new pod could not be scheduled alongside the old one. The UserSync Helm chart now defaults to the Recreate update strategy.

Updated property definitions now reach applications that are already deployed¶

When a release changes how an application's configuration property is defined, applications that were deployed earlier now pick up the new definition. The values you set are kept. Previously, an existing application kept the definition it was created with.

Runtime planes that share a Route 53 zone no longer hit its rate limit¶

Many runtime planes can now share one Amazon Route 53 hosted zone without exhausting its API rate limit, so DNS records keep updating as you add planes.

Load balancer health checks now report Audit Server, Solr and Diagnostics Server correctly¶

Runtime planes behind an AWS Application Load Balancer now get health checks that match each service, so Audit Server, Solr and Diagnostics Server no longer show as unhealthy targets. Portal and Ranger health probes now check that the service answers over HTTPS, not just that its port is open, and Data Server gains a readiness probe. Portal, Ranger and Data Server restart during the upgrade.

Kubernetes settings follow the connector's Shared or Dedicated mode¶

On the connection form, Kubernetes settings now appear according to whether the connector runs in Shared or Dedicated mode, for every connector type that can run on a shared host.

Monitoring settings show again on older AI Assets Collector applications¶

On some AI Assets Collector applications, the Monitoring section of the connection form was empty, so trace collection settings could not be seen or changed. The section now shows its settings on these collectors.

Runtime pages no longer show the wrong tabs or buttons while loading¶

Runtime pages such as plane details, the add-connector catalog and the UserSync list now wait for their data before showing tabs, buttons and connector cards, so they no longer show the wrong layout for a moment.

Clearer connector application list¶

Fixed layout issues in the connector application list: overlapping status text in the Updated At and Actions columns, a cramped App Status cell for shared applications, and unclear action controls.

[Self-Managed only] Updated infrastructure images on Self-Managed runtime planes¶

Self-Managed runtime planes now use updated Grafana, Prometheus, Prometheus config reloader, OpenTelemetry Collector, ZooKeeper, PostgreSQL and OpenSearch images, to address known security vulnerabilities.