Overview

openLooKeng is a drop in engine which enables in-situ analytics on any data, anywhere, including geographically remote data sources. It provides a global view of all of your data via its SQL 2003 interface. With high availability, auto-scaling, built-in caching and indexing support, openLooKeng is ready for enterprise workload with required reliability.

openlookeng-ranger-plugin is a Ranger Plugin for openLooKeng to enable, monitor and manage comprehensive data security.

Build Process

Check out the code from GIT repository
On the root folder, please execute the following Maven command:

mvn clean package

After the above build command execution, you would see the following TAR files in the target folder:

ranger-<ranger.version>-admin-openlookeng-<openlookeng.version>-plugin.tar.gz
ranger-<ranger.version>-openlookeng-<openlookeng.version>-plugin.tar.gz

Deployment Process

Install Ranger Admin plugin

1). Expand the ranger-<ranger.version>-admin-openlookeng-<openlookeng.version>-plugin.tar.gz file, you would see the following folders in the target folder:

openlookeng
service-defs

2). Register Service Type definition with Ranger

Service type definition should be registered with Ranger using REST API provided by Ranger Admin. Once registered, Ranger Admin will provide UI to create service instances (called as repositories in previous releases) and policies for the service-type. Ranger plugin uses the service type definition and the policies to determine if an access request should be granted or not. The register REST API can be invoked using curl command as shown in the example below :

curl -u admin:password -X POST -H "Accept: application/json" -H "Content-Type: application/json" -d @service-defs/ranger-servicedef-openlookeng.json http://ranger-admin-host:port/service/plugins/definitions

The example of query REST API of Ranger:

curl -u admin:password -X GET -H "Accept: application/json" -H "Content-Type: application/json" http://ranger-admin-host:port/service/plugins/definitions

The example of delete REST API of Ranger:

curl -u admin:password -X DELETE http://ranger-admin-host:port/service/plugins/definitions/{service id}

3). Copy openlookeng folder to ranger-plugins folder of Ranger Admin installed directory (e.g. ranger-<ranger.version>-admin/ews/webapp/WEB-INF/classes/ranger-plugins/)

Install openLooKeng plugin

1). Expand the ranger-<ranger.version>-openlookeng-<openlookeng.version>-plugin.tar.gz file

2). Modify the install.properties file with appropriate variables. There is an example that some variables were modified as follows:

# Location of Policy Manager URL
# Example: POLICY_MGR_URL=http://policymanager.xasecure.net:6080
POLICY_MGR_URL=http://xxx.xxx.xxx.xxx:6080

# This is the repository name created within policy manager
# Example: REPOSITORY_NAME=openlookengdev
REPOSITORY_NAME=openlookengdev

# openLooKeng component installed directory
# COMPONENT_INSTALL_DIR_NAME=../openlookeng
COMPONENT_INSTALL_DIR_NAME=/home/hetu-server-1.0.1

XAAUDIT.SOLR.ENABLE=false
XAAUDIT.SUMMARY.ENABLE=false

3). Execute ./enable-openlookeng-plugin.sh

Restart service

Restart Ranger Admin service: service ranger-admin restart
Restart openLooKeng service: ./launcher restart

Ranger Policy Manager

You can add a new policy from the Ranger Admin's Policy Listing Page of openLooKeng service. The ranger plugin of openLooKeng supports manager the privileges of systemproperty, catalog, sessionproperty, schema, table and column.

Privilege Statement

systemproperty
- alter : Set a system session property value.
catalog
- use : If not grant use privilege to catalog, all operations under the catalog have no permission.
- select : Only the select privilege was granted, the catalog can be available for show catalogs.
- create : Create a new, empty schema.
- show : List the available schemas in catalog or in the current catalog.
sessionproperty
- alter : Set a catalog session property value.
impersonateuser
- impersonate : Impersonate openLooKeng query user for the authenticated user of Kerberos or LDAP.
schema
- drop : Drop an existing schema.
- alter : Change the definition of an existing schema.
- select : Only the select privilege was granted, the schema can be available for show schemas.
- create : Create a new, empty table with the specified columns; Create a new view of a select query.
- show : List the available tables in schema or in the current schema.
table
- drop : Drop existing table, view and column.
- alter : Change the definition of an existing table; Set the comment for a table; Update the values of the specified columns in all rows that satisfy the condition.
- insert : Insert new rows into a table.
- delete : Delete rows from a table.
- grant : Grants the specified privileges to the specified grantee.
- revoke : Revokes the specified privileges from the specified grantee.
- select : Only the select privilege was granted, the table can be available for show tables.
- show : List the available columns in table along with their data type and other attributes.
column
- select : Retrieve rows from zero or more tables; Only the select privilege was granted, the column can be available for show columns.

Column mask

Column mask is only suitable for select operation, the specified user can only access the data after the mask. At present, openLooKeng support 8 mask policies.

Masking Option	Description
`Redact`	Replace lowercase with `x`, uppercase with `X`, digits with `0`.
`Partial mask: show last 4`	Show last 4 characters; replace rest with `X`.
`Partial mask: show first 4`	Show first 4 characters; replace rest with `x`.
`Hash`	Hash the value of a varchar with sha256.
`Nullify`	Replace with NULL.
`Unmasked (retain original value)`	No masking.
`Date: show only year`	Date: show only year.
`Custom`	Custom. Example: cast(concat({col}, "test") as {type}).

Row filter

Row filter is only suitable for select operation, the specified user can only access the data after filter. You can customize the filter expression as the condition in where of SQL.

Policy Reference

Basically, use and select privileges should be granted to a particular catalog. show or create privileges are optional to enable show or create schemas.

Label	Description
Policy Name	Enter an appropriate policy name.
catalog	Select the appropriate catalog.
none	Label none indicates don't need to config other resources.

If you want to access metadata of the catalog (e.g. show schemas/tables/columns), you should grant select privilege to information_schema of particular catalog.

Label	Description
Policy Name	Enter an appropriate policy name.
catalog	Select the appropriate catalog.
schema	select `information_schema`.
table	* (indicates select all tables)
column	* (indicates select all columns)

You can create a policy for system session property.

Label	Description
Policy Name	Enter an appropriate policy name.
systemproperty	Specify the appropriate system session property.

You can create a policy for catalog session property.

Label	Description
Policy Name	Enter an appropriate policy name.
catalog	Select the appropriate catalog.
sessionproperty	Specify the appropriate catalog session property.

You can create a policy for a combination for catalog, schema, table and column.

Label	Description
Policy Name	Enter an appropriate policy name.
catalog	Select the appropriate catalog.
schema	For the selected catalog(s), select schema(s) for the which the policy will be applicable.
table	For the selected catalog(s) and schema(s), select table(s) for the which the policy will be applicable.
column	For the selected catalog(s), schema(s) and table(s), select column(s) for the which the policy will be applicable

openLooKeng / openlookeng-ranger-plugin

Overview

Build Process

Deployment Process

Install Ranger Admin plugin

Install openLooKeng plugin

Restart service

Ranger Policy Manager

Privilege Statement

Column mask

Row filter

Policy Reference

简介

发行版

贡献者

近期动态

openLooKeng / openlookeng-ranger-plugin .gitee-modal { width: 500px !important; }

Overview

Build Process

Deployment Process

Install Ranger Admin plugin

Install openLooKeng plugin

Restart service

Ranger Policy Manager

Privilege Statement

Column mask

Row filter

Policy Reference

简介

发行版

贡献者

近期动态

搜索帮助

openLooKeng / openlookeng-ranger-plugin