This is an automated email from the ASF dual-hosted git repository.
kassiez pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/doris-website.git
The following commit(s) were added to refs/heads/master by this push:
new ca7558c2d4a [auth]Improve the ranger documentation (#2136)
ca7558c2d4a is described below
commit ca7558c2d4a6daf5746c4d7368e564f388d75357
Author: zhangdong <[email protected]>
AuthorDate: Wed Mar 5 15:26:29 2025 +0800
[auth]Improve the ranger documentation (#2136)
- Super users are not controlled by datamask
- Ranger example configuration file
- Configuring row permissions still requires configuring relevant
permissions
## Versions
- [x] dev
- [x] 3.0
- [x] 2.1
- [ ] 2.0
## Languages
- [x] Chinese
- [x] English
## Docs Checklist
- [ ] Checked by AI
- [ ] Test Cases Built
---
docs/admin-manual/auth/authorization/data.md | 2 +
docs/admin-manual/auth/authorization/ranger.md | 45 ++++++++++++++++++++-
.../admin-manual/auth/authorization/data.md | 2 +
.../admin-manual/auth/authorization/ranger.md | 46 +++++++++++++++++++++-
.../admin-manual/auth/authorization/data.md | 2 +
.../admin-manual/auth/authorization/ranger.md | 46 +++++++++++++++++++++-
.../admin-manual/auth/authorization/data.md | 2 +
.../admin-manual/auth/authorization/ranger.md | 46 +++++++++++++++++++++-
.../admin-manual/auth/authorization/data.md | 2 +
.../admin-manual/auth/authorization/ranger.md | 45 ++++++++++++++++++++-
.../admin-manual/auth/authorization/data.md | 2 +
.../admin-manual/auth/authorization/ranger.md | 45 ++++++++++++++++++++-
12 files changed, 279 insertions(+), 6 deletions(-)
diff --git a/docs/admin-manual/auth/authorization/data.md
b/docs/admin-manual/auth/authorization/data.md
index cbfc49d29f4..e6256951446 100644
--- a/docs/admin-manual/auth/authorization/data.md
+++ b/docs/admin-manual/auth/authorization/data.md
@@ -71,3 +71,5 @@ Data masking is a method to protect sensitive data by
modifying, replacing, or h
For example, administrators can choose to replace part or all of the digits of
sensitive fields such as credit card numbers or ID numbers with asterisks * or
other characters, or replace real names with pseudonyms.
Starting from version 2.1.2, data masking is supported through Apache Ranger's
Data Masking to set masking policies for certain columns, currently only
through [Apache Ranger](ranger.md).
+
+> Data Masking settings for admin/root users will not take effect.
\ No newline at end of file
diff --git a/docs/admin-manual/auth/authorization/ranger.md
b/docs/admin-manual/auth/authorization/ranger.md
index f329af32ff3..7820e2f9265 100644
--- a/docs/admin-manual/auth/authorization/ranger.md
+++ b/docs/admin-manual/auth/authorization/ranger.md
@@ -30,7 +30,44 @@ Apache Ranger is a security framework used for monitoring,
enabling services, an
### Change Doris Configuration
1. In the `fe/conf/fe.conf` file, configure the authorization method as
`ranger access_controller_type=ranger-doris`.
-2. In the `fe/conf/ranger-doris-security.xml` file, configure the basic
information of Ranger.
+2. Create a `ranger-doris-security.xml` file in the conf directory of all FEs
with the following content:
+
+ ```
+ <?xml version="1.0" encoding="UTF-8"?>
+ <?xml-stylesheet type="text/xsl" href="configuration.xsl"?>
+ <configuration>
+ <property>
+ <name>ranger.plugin.doris.policy.cache.dir</name>
+ <value>/path/to/ranger/cache/</value>
+ </property>
+ <property>
+ <name>ranger.plugin.doris.policy.pollIntervalMs</name>
+ <value>30000</value>
+ </property>
+ <property>
+
<name>ranger.plugin.doris.policy.rest.client.connection.timeoutMs</name>
+ <value>60000</value>
+ </property>
+ <property>
+ <name>ranger.plugin.doris.policy.rest.client.read.timeoutMs</name>
+ <value>60000</value>
+ </property>
+ <property>
+ <name>ranger.plugin.doris.policy.rest.url</name>
+ <value>http://172.21.0.32:6080</value>
+ </property>
+ <property>
+ <name>ranger.plugin.doris.policy.source.impl</name>
+ <value>org.apache.ranger.admin.client.RangerAdminRESTClient</value>
+ </property>
+ <property>
+ <name>ranger.plugin.doris.service.name</name>
+ <value>doris</value>
+ </property>
+ </configuration>
+ ```
+
+ Among which, the `ranger.plugin.doris.policy.cache.dir` and
`ranger.plugin.doris.policy.rest.url` need to be modified to their actual
values.
3. Start the cluster.
### Permission Example
@@ -56,6 +93,8 @@ Equivalent to the internal Doris authorization statement
`grant select_priv on h
#### Table Permissions
+> Here, the term "table" generally refers to tables, views, and asynchronous
materialized views.
+
Equivalent to the internal Doris authorization statement `grant select_priv on
hive.db1.tbl1 to user1`;
@@ -101,6 +140,7 @@ Equivalent to the internal Doris authorization statement
`grant usage_priv on wo
## Frequently Asked Questions
1. How to view the log when Ranger access fails?
+
Create a `log4j.properties` file in the `conf` directory of all FEs, with
the following content:
```
@@ -120,6 +160,9 @@ Equivalent to the internal Doris authorization statement
`grant usage_priv on wo
```
Change `log4j.appender.D.File` to the actual path, which is used to store
the Ranger plugin log.
+2. A Row Level Filter policy has been configured, but the user encounters a
permission denied error when querying.
+
+ The Row Level Filter policy is solely used to restrict users from accessing
specific records within a table's data; authorization for the user must still
be granted through an ACCESS POLICY.
## Install and Configure Doris Ranger Plugin
diff --git
a/i18n/zh-CN/docusaurus-plugin-content-docs/current/admin-manual/auth/authorization/data.md
b/i18n/zh-CN/docusaurus-plugin-content-docs/current/admin-manual/auth/authorization/data.md
index 3f9354b70aa..3502d28aea6 100644
---
a/i18n/zh-CN/docusaurus-plugin-content-docs/current/admin-manual/auth/authorization/data.md
+++
b/i18n/zh-CN/docusaurus-plugin-content-docs/current/admin-manual/auth/authorization/data.md
@@ -67,3 +67,5 @@ GRANT Select_priv(col1,col2) ON ctl.db.tbl TO user1
例如，管理员可以选择将信用卡号、身份证号等敏感字段的部分或全部数字替换为星号 * 或其他字符，或者将真实姓名替换为假名。
从 2.1.2 版本开始，支持通过 Apache Ranger 的 Data Masking 来为某些列设置脱敏策略，目前仅支持通过 [Apache
Ranger](./ranger)来设置
+
+> 为 admin/root 用户设置数据脱敏不会生效
diff --git
a/i18n/zh-CN/docusaurus-plugin-content-docs/current/admin-manual/auth/authorization/ranger.md
b/i18n/zh-CN/docusaurus-plugin-content-docs/current/admin-manual/auth/authorization/ranger.md
index 0c68eb2123b..cdb98f69208 100644
---
a/i18n/zh-CN/docusaurus-plugin-content-docs/current/admin-manual/auth/authorization/ranger.md
+++
b/i18n/zh-CN/docusaurus-plugin-content-docs/current/admin-manual/auth/authorization/ranger.md
@@ -31,7 +31,44 @@ Ranger 的安装和配置见下文：安装和配置 Doris Ranger 插件
## Ranger 示例
### 更改 Doris 配置
1. 在 fe/conf/fe.conf 文件中配置鉴权方式为 ranger access_controller_type=ranger-doris
-2. 在 fe/conf/ranger-doris-security.xml 文件中配置 ranger 基本信息
+2. 在所有 FE 的 conf 目录创建 `ranger-doris-security.xml` 文件，内容如下：
+
+ ```
+ <?xml version="1.0" encoding="UTF-8"?>
+ <?xml-stylesheet type="text/xsl" href="configuration.xsl"?>
+ <configuration>
+ <property>
+ <name>ranger.plugin.doris.policy.cache.dir</name>
+ <value>/path/to/ranger/cache/</value>
+ </property>
+ <property>
+ <name>ranger.plugin.doris.policy.pollIntervalMs</name>
+ <value>30000</value>
+ </property>
+ <property>
+
<name>ranger.plugin.doris.policy.rest.client.connection.timeoutMs</name>
+ <value>60000</value>
+ </property>
+ <property>
+ <name>ranger.plugin.doris.policy.rest.client.read.timeoutMs</name>
+ <value>60000</value>
+ </property>
+ <property>
+ <name>ranger.plugin.doris.policy.rest.url</name>
+ <value>http://172.21.0.32:6080</value>
+ </property>
+ <property>
+ <name>ranger.plugin.doris.policy.source.impl</name>
+ <value>org.apache.ranger.admin.client.RangerAdminRESTClient</value>
+ </property>
+ <property>
+ <name>ranger.plugin.doris.service.name</name>
+ <value>doris</value>
+ </property>
+ </configuration>
+ ```
+
+ 其中需要将 `ranger.plugin.doris.policy.cache.dir` 和
`ranger.plugin.doris.policy.rest.url` 改为实际值。
3. 启动集群
### 权限示例
1. 在 Doris 中创建 `user1`。
@@ -56,6 +93,8 @@ Ranger 的安装和配置见下文：安装和配置 Doris Ranger 插件
#### Table 权限
+> 这里的table泛指 表/视图/异步物化视图
+
相当于 Doris 内部授权语句的 `grant select_priv on hive.tpch.user to user1`;
@@ -100,6 +139,7 @@ Ranger 的安装和配置见下文：安装和配置 Doris Ranger 插件
3. 使用 user1 登录 Doris。执行 `select * from internal.db1.user`，看到的 phone
是按照指定规则脱敏后的数据。
## 常见问题
1. ranger 访问失败，怎么查看日志
+
在所有 FE 的 conf 目录创建 log4j.properties 文件，内容如下：
```
@@ -119,6 +159,10 @@ Ranger 的安装和配置见下文：安装和配置 Doris Ranger 插件
```
其中 `log4j.appender.D.File` 改为实际值，用于存放 Ranger 插件的日志。
+2. 配置了 Row Level Filter policy ，但是用户查询时报没有权限
+
+ Row Level Filter policy 仅用来限制用户访问表中数据的特定记录， 仍需通过 ACCESS POLICY 为用户授权
+
## 安装和配置 Doris Ranger 插件
### 安装插件
diff --git
a/i18n/zh-CN/docusaurus-plugin-content-docs/version-2.1/admin-manual/auth/authorization/data.md
b/i18n/zh-CN/docusaurus-plugin-content-docs/version-2.1/admin-manual/auth/authorization/data.md
index 3f9354b70aa..3502d28aea6 100644
---
a/i18n/zh-CN/docusaurus-plugin-content-docs/version-2.1/admin-manual/auth/authorization/data.md
+++
b/i18n/zh-CN/docusaurus-plugin-content-docs/version-2.1/admin-manual/auth/authorization/data.md
@@ -67,3 +67,5 @@ GRANT Select_priv(col1,col2) ON ctl.db.tbl TO user1
例如，管理员可以选择将信用卡号、身份证号等敏感字段的部分或全部数字替换为星号 * 或其他字符，或者将真实姓名替换为假名。
从 2.1.2 版本开始，支持通过 Apache Ranger 的 Data Masking 来为某些列设置脱敏策略，目前仅支持通过 [Apache
Ranger](./ranger)来设置
+
+> 为 admin/root 用户设置数据脱敏不会生效
diff --git
a/i18n/zh-CN/docusaurus-plugin-content-docs/version-2.1/admin-manual/auth/authorization/ranger.md
b/i18n/zh-CN/docusaurus-plugin-content-docs/version-2.1/admin-manual/auth/authorization/ranger.md
index 0c68eb2123b..cdb98f69208 100644
---
a/i18n/zh-CN/docusaurus-plugin-content-docs/version-2.1/admin-manual/auth/authorization/ranger.md
+++
b/i18n/zh-CN/docusaurus-plugin-content-docs/version-2.1/admin-manual/auth/authorization/ranger.md
@@ -31,7 +31,44 @@ Ranger 的安装和配置见下文：安装和配置 Doris Ranger 插件
## Ranger 示例
### 更改 Doris 配置
1. 在 fe/conf/fe.conf 文件中配置鉴权方式为 ranger access_controller_type=ranger-doris
-2. 在 fe/conf/ranger-doris-security.xml 文件中配置 ranger 基本信息
+2. 在所有 FE 的 conf 目录创建 `ranger-doris-security.xml` 文件，内容如下：
+
+ ```
+ <?xml version="1.0" encoding="UTF-8"?>
+ <?xml-stylesheet type="text/xsl" href="configuration.xsl"?>
+ <configuration>
+ <property>
+ <name>ranger.plugin.doris.policy.cache.dir</name>
+ <value>/path/to/ranger/cache/</value>
+ </property>
+ <property>
+ <name>ranger.plugin.doris.policy.pollIntervalMs</name>
+ <value>30000</value>
+ </property>
+ <property>
+
<name>ranger.plugin.doris.policy.rest.client.connection.timeoutMs</name>
+ <value>60000</value>
+ </property>
+ <property>
+ <name>ranger.plugin.doris.policy.rest.client.read.timeoutMs</name>
+ <value>60000</value>
+ </property>
+ <property>
+ <name>ranger.plugin.doris.policy.rest.url</name>
+ <value>http://172.21.0.32:6080</value>
+ </property>
+ <property>
+ <name>ranger.plugin.doris.policy.source.impl</name>
+ <value>org.apache.ranger.admin.client.RangerAdminRESTClient</value>
+ </property>
+ <property>
+ <name>ranger.plugin.doris.service.name</name>
+ <value>doris</value>
+ </property>
+ </configuration>
+ ```
+
+ 其中需要将 `ranger.plugin.doris.policy.cache.dir` 和
`ranger.plugin.doris.policy.rest.url` 改为实际值。
3. 启动集群
### 权限示例
1. 在 Doris 中创建 `user1`。
@@ -56,6 +93,8 @@ Ranger 的安装和配置见下文：安装和配置 Doris Ranger 插件
#### Table 权限
+> 这里的table泛指 表/视图/异步物化视图
+
相当于 Doris 内部授权语句的 `grant select_priv on hive.tpch.user to user1`;
@@ -100,6 +139,7 @@ Ranger 的安装和配置见下文：安装和配置 Doris Ranger 插件
3. 使用 user1 登录 Doris。执行 `select * from internal.db1.user`，看到的 phone
是按照指定规则脱敏后的数据。
## 常见问题
1. ranger 访问失败，怎么查看日志
+
在所有 FE 的 conf 目录创建 log4j.properties 文件，内容如下：
```
@@ -119,6 +159,10 @@ Ranger 的安装和配置见下文：安装和配置 Doris Ranger 插件
```
其中 `log4j.appender.D.File` 改为实际值，用于存放 Ranger 插件的日志。
+2. 配置了 Row Level Filter policy ，但是用户查询时报没有权限
+
+ Row Level Filter policy 仅用来限制用户访问表中数据的特定记录， 仍需通过 ACCESS POLICY 为用户授权
+
## 安装和配置 Doris Ranger 插件
### 安装插件
diff --git
a/i18n/zh-CN/docusaurus-plugin-content-docs/version-3.0/admin-manual/auth/authorization/data.md
b/i18n/zh-CN/docusaurus-plugin-content-docs/version-3.0/admin-manual/auth/authorization/data.md
index 3f9354b70aa..3502d28aea6 100644
---
a/i18n/zh-CN/docusaurus-plugin-content-docs/version-3.0/admin-manual/auth/authorization/data.md
+++
b/i18n/zh-CN/docusaurus-plugin-content-docs/version-3.0/admin-manual/auth/authorization/data.md
@@ -67,3 +67,5 @@ GRANT Select_priv(col1,col2) ON ctl.db.tbl TO user1
例如，管理员可以选择将信用卡号、身份证号等敏感字段的部分或全部数字替换为星号 * 或其他字符，或者将真实姓名替换为假名。
从 2.1.2 版本开始，支持通过 Apache Ranger 的 Data Masking 来为某些列设置脱敏策略，目前仅支持通过 [Apache
Ranger](./ranger)来设置
+
+> 为 admin/root 用户设置数据脱敏不会生效
diff --git
a/i18n/zh-CN/docusaurus-plugin-content-docs/version-3.0/admin-manual/auth/authorization/ranger.md
b/i18n/zh-CN/docusaurus-plugin-content-docs/version-3.0/admin-manual/auth/authorization/ranger.md
index 0c68eb2123b..cdb98f69208 100644
---
a/i18n/zh-CN/docusaurus-plugin-content-docs/version-3.0/admin-manual/auth/authorization/ranger.md
+++
b/i18n/zh-CN/docusaurus-plugin-content-docs/version-3.0/admin-manual/auth/authorization/ranger.md
@@ -31,7 +31,44 @@ Ranger 的安装和配置见下文：安装和配置 Doris Ranger 插件
## Ranger 示例
### 更改 Doris 配置
1. 在 fe/conf/fe.conf 文件中配置鉴权方式为 ranger access_controller_type=ranger-doris
-2. 在 fe/conf/ranger-doris-security.xml 文件中配置 ranger 基本信息
+2. 在所有 FE 的 conf 目录创建 `ranger-doris-security.xml` 文件，内容如下：
+
+ ```
+ <?xml version="1.0" encoding="UTF-8"?>
+ <?xml-stylesheet type="text/xsl" href="configuration.xsl"?>
+ <configuration>
+ <property>
+ <name>ranger.plugin.doris.policy.cache.dir</name>
+ <value>/path/to/ranger/cache/</value>
+ </property>
+ <property>
+ <name>ranger.plugin.doris.policy.pollIntervalMs</name>
+ <value>30000</value>
+ </property>
+ <property>
+
<name>ranger.plugin.doris.policy.rest.client.connection.timeoutMs</name>
+ <value>60000</value>
+ </property>
+ <property>
+ <name>ranger.plugin.doris.policy.rest.client.read.timeoutMs</name>
+ <value>60000</value>
+ </property>
+ <property>
+ <name>ranger.plugin.doris.policy.rest.url</name>
+ <value>http://172.21.0.32:6080</value>
+ </property>
+ <property>
+ <name>ranger.plugin.doris.policy.source.impl</name>
+ <value>org.apache.ranger.admin.client.RangerAdminRESTClient</value>
+ </property>
+ <property>
+ <name>ranger.plugin.doris.service.name</name>
+ <value>doris</value>
+ </property>
+ </configuration>
+ ```
+
+ 其中需要将 `ranger.plugin.doris.policy.cache.dir` 和
`ranger.plugin.doris.policy.rest.url` 改为实际值。
3. 启动集群
### 权限示例
1. 在 Doris 中创建 `user1`。
@@ -56,6 +93,8 @@ Ranger 的安装和配置见下文：安装和配置 Doris Ranger 插件
#### Table 权限
+> 这里的table泛指 表/视图/异步物化视图
+
相当于 Doris 内部授权语句的 `grant select_priv on hive.tpch.user to user1`;
@@ -100,6 +139,7 @@ Ranger 的安装和配置见下文：安装和配置 Doris Ranger 插件
3. 使用 user1 登录 Doris。执行 `select * from internal.db1.user`，看到的 phone
是按照指定规则脱敏后的数据。
## 常见问题
1. ranger 访问失败，怎么查看日志
+
在所有 FE 的 conf 目录创建 log4j.properties 文件，内容如下：
```
@@ -119,6 +159,10 @@ Ranger 的安装和配置见下文：安装和配置 Doris Ranger 插件
```
其中 `log4j.appender.D.File` 改为实际值，用于存放 Ranger 插件的日志。
+2. 配置了 Row Level Filter policy ，但是用户查询时报没有权限
+
+ Row Level Filter policy 仅用来限制用户访问表中数据的特定记录， 仍需通过 ACCESS POLICY 为用户授权
+
## 安装和配置 Doris Ranger 插件
### 安装插件
diff --git a/versioned_docs/version-2.1/admin-manual/auth/authorization/data.md
b/versioned_docs/version-2.1/admin-manual/auth/authorization/data.md
index 1056fc45741..1e7c718cd3a 100644
--- a/versioned_docs/version-2.1/admin-manual/auth/authorization/data.md
+++ b/versioned_docs/version-2.1/admin-manual/auth/authorization/data.md
@@ -71,3 +71,5 @@ Data masking is a method to protect sensitive data by
modifying, replacing, or h
For example, administrators can choose to replace part or all of the digits of
sensitive fields such as credit card numbers or ID numbers with asterisks * or
other characters, or replace real names with pseudonyms.
Starting from version 2.1.2, data masking is supported through Apache Ranger's
Data Masking to set masking policies for certain columns, currently only
through [Apache Ranger](ranger.md).
+
+> Data Masking settings for admin/root users will not take effect.
\ No newline at end of file
diff --git
a/versioned_docs/version-2.1/admin-manual/auth/authorization/ranger.md
b/versioned_docs/version-2.1/admin-manual/auth/authorization/ranger.md
index f329af32ff3..7820e2f9265 100644
--- a/versioned_docs/version-2.1/admin-manual/auth/authorization/ranger.md
+++ b/versioned_docs/version-2.1/admin-manual/auth/authorization/ranger.md
@@ -30,7 +30,44 @@ Apache Ranger is a security framework used for monitoring,
enabling services, an
### Change Doris Configuration
1. In the `fe/conf/fe.conf` file, configure the authorization method as
`ranger access_controller_type=ranger-doris`.
-2. In the `fe/conf/ranger-doris-security.xml` file, configure the basic
information of Ranger.
+2. Create a `ranger-doris-security.xml` file in the conf directory of all FEs
with the following content:
+
+ ```
+ <?xml version="1.0" encoding="UTF-8"?>
+ <?xml-stylesheet type="text/xsl" href="configuration.xsl"?>
+ <configuration>
+ <property>
+ <name>ranger.plugin.doris.policy.cache.dir</name>
+ <value>/path/to/ranger/cache/</value>
+ </property>
+ <property>
+ <name>ranger.plugin.doris.policy.pollIntervalMs</name>
+ <value>30000</value>
+ </property>
+ <property>
+
<name>ranger.plugin.doris.policy.rest.client.connection.timeoutMs</name>
+ <value>60000</value>
+ </property>
+ <property>
+ <name>ranger.plugin.doris.policy.rest.client.read.timeoutMs</name>
+ <value>60000</value>
+ </property>
+ <property>
+ <name>ranger.plugin.doris.policy.rest.url</name>
+ <value>http://172.21.0.32:6080</value>
+ </property>
+ <property>
+ <name>ranger.plugin.doris.policy.source.impl</name>
+ <value>org.apache.ranger.admin.client.RangerAdminRESTClient</value>
+ </property>
+ <property>
+ <name>ranger.plugin.doris.service.name</name>
+ <value>doris</value>
+ </property>
+ </configuration>
+ ```
+
+ Among which, the `ranger.plugin.doris.policy.cache.dir` and
`ranger.plugin.doris.policy.rest.url` need to be modified to their actual
values.
3. Start the cluster.
### Permission Example
@@ -56,6 +93,8 @@ Equivalent to the internal Doris authorization statement
`grant select_priv on h
#### Table Permissions
+> Here, the term "table" generally refers to tables, views, and asynchronous
materialized views.
+
Equivalent to the internal Doris authorization statement `grant select_priv on
hive.db1.tbl1 to user1`;
@@ -101,6 +140,7 @@ Equivalent to the internal Doris authorization statement
`grant usage_priv on wo
## Frequently Asked Questions
1. How to view the log when Ranger access fails?
+
Create a `log4j.properties` file in the `conf` directory of all FEs, with
the following content:
```
@@ -120,6 +160,9 @@ Equivalent to the internal Doris authorization statement
`grant usage_priv on wo
```
Change `log4j.appender.D.File` to the actual path, which is used to store
the Ranger plugin log.
+2. A Row Level Filter policy has been configured, but the user encounters a
permission denied error when querying.
+
+ The Row Level Filter policy is solely used to restrict users from accessing
specific records within a table's data; authorization for the user must still
be granted through an ACCESS POLICY.
## Install and Configure Doris Ranger Plugin
diff --git a/versioned_docs/version-3.0/admin-manual/auth/authorization/data.md
b/versioned_docs/version-3.0/admin-manual/auth/authorization/data.md
index 1056fc45741..1e7c718cd3a 100644
--- a/versioned_docs/version-3.0/admin-manual/auth/authorization/data.md
+++ b/versioned_docs/version-3.0/admin-manual/auth/authorization/data.md
@@ -71,3 +71,5 @@ Data masking is a method to protect sensitive data by
modifying, replacing, or h
For example, administrators can choose to replace part or all of the digits of
sensitive fields such as credit card numbers or ID numbers with asterisks * or
other characters, or replace real names with pseudonyms.
Starting from version 2.1.2, data masking is supported through Apache Ranger's
Data Masking to set masking policies for certain columns, currently only
through [Apache Ranger](ranger.md).
+
+> Data Masking settings for admin/root users will not take effect.
\ No newline at end of file
diff --git
a/versioned_docs/version-3.0/admin-manual/auth/authorization/ranger.md
b/versioned_docs/version-3.0/admin-manual/auth/authorization/ranger.md
index f329af32ff3..7820e2f9265 100644
--- a/versioned_docs/version-3.0/admin-manual/auth/authorization/ranger.md
+++ b/versioned_docs/version-3.0/admin-manual/auth/authorization/ranger.md
@@ -30,7 +30,44 @@ Apache Ranger is a security framework used for monitoring,
enabling services, an
### Change Doris Configuration
1. In the `fe/conf/fe.conf` file, configure the authorization method as
`ranger access_controller_type=ranger-doris`.
-2. In the `fe/conf/ranger-doris-security.xml` file, configure the basic
information of Ranger.
+2. Create a `ranger-doris-security.xml` file in the conf directory of all FEs
with the following content:
+
+ ```
+ <?xml version="1.0" encoding="UTF-8"?>
+ <?xml-stylesheet type="text/xsl" href="configuration.xsl"?>
+ <configuration>
+ <property>
+ <name>ranger.plugin.doris.policy.cache.dir</name>
+ <value>/path/to/ranger/cache/</value>
+ </property>
+ <property>
+ <name>ranger.plugin.doris.policy.pollIntervalMs</name>
+ <value>30000</value>
+ </property>
+ <property>
+
<name>ranger.plugin.doris.policy.rest.client.connection.timeoutMs</name>
+ <value>60000</value>
+ </property>
+ <property>
+ <name>ranger.plugin.doris.policy.rest.client.read.timeoutMs</name>
+ <value>60000</value>
+ </property>
+ <property>
+ <name>ranger.plugin.doris.policy.rest.url</name>
+ <value>http://172.21.0.32:6080</value>
+ </property>
+ <property>
+ <name>ranger.plugin.doris.policy.source.impl</name>
+ <value>org.apache.ranger.admin.client.RangerAdminRESTClient</value>
+ </property>
+ <property>
+ <name>ranger.plugin.doris.service.name</name>
+ <value>doris</value>
+ </property>
+ </configuration>
+ ```
+
+ Among which, the `ranger.plugin.doris.policy.cache.dir` and
`ranger.plugin.doris.policy.rest.url` need to be modified to their actual
values.
3. Start the cluster.
### Permission Example
@@ -56,6 +93,8 @@ Equivalent to the internal Doris authorization statement
`grant select_priv on h
#### Table Permissions
+> Here, the term "table" generally refers to tables, views, and asynchronous
materialized views.
+
Equivalent to the internal Doris authorization statement `grant select_priv on
hive.db1.tbl1 to user1`;
@@ -101,6 +140,7 @@ Equivalent to the internal Doris authorization statement
`grant usage_priv on wo
## Frequently Asked Questions
1. How to view the log when Ranger access fails?
+
Create a `log4j.properties` file in the `conf` directory of all FEs, with
the following content:
```
@@ -120,6 +160,9 @@ Equivalent to the internal Doris authorization statement
`grant usage_priv on wo
```
Change `log4j.appender.D.File` to the actual path, which is used to store
the Ranger plugin log.
+2. A Row Level Filter policy has been configured, but the user encounters a
permission denied error when querying.
+
+ The Row Level Filter policy is solely used to restrict users from accessing
specific records within a table's data; authorization for the user must still
be granted through an ACCESS POLICY.
## Install and Configure Doris Ranger Plugin
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
