[
https://issues.apache.org/jira/browse/RANGER-2962?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17292254#comment-17292254
]
Quanlong Huang commented on RANGER-2962:
----------------------------------------
I'm also a Ranger user. Does "{{user_name = current_user()}}" fit your
requirement?
I think you can also use subquery filters for complex and flexible control:
[https://cwiki.apache.org/confluence/display/RANGER/Row-level+filtering+and+column-masking+using+Apache+Ranger+policies+in+Apache+Hive#RowlevelfilteringandcolumnmaskingusingApacheRangerpoliciesinApacheHive-Usecase#2:restrictuserstoaccesssubsetofrowsbasedondatainanothertable]
> Ranger Row Level Filter (See only data corresponding to user logged in
> without the need to create multiple user entries in policy)
> ----------------------------------------------------------------------------------------------------------------------------------
>
> Key: RANGER-2962
> URL: https://issues.apache.org/jira/browse/RANGER-2962
> Project: Ranger
> Issue Type: Improvement
> Components: Ranger
> Reporter: Mudit Sharma
> Priority: Major
> Attachments:
> 0001-RANGER-2962-USER-Transformation-in-Hive-Plugin-s-Row.patch
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> We are using Apache Ranger as our Security pipeline. We found out that Ranger
> has a Row Level Filter option where we can limit the data visible to
> particular users. The issue we are facing is that, let's say there are some
> 100 or 1000 of users which we need to restrict to see only their own data in
> a particular hive table, we need to create 100 or 1000 entries in Ranger Row
> Level Policy, for ex: for each user A, we need to create a separate filter in
> policy saying user_name = "A". This sometimes hit the DB limit for a policy
> meta and we need to bifurcate the policy into 2-3 or many parts. Is there a
> way making use of \{USER} and user_name = \{USER}, we can restrict each user
> to see only its own data?
>
>
> Also, in Row Level Filter currently we allow only Select, I would like to
> check if we are looking forward for more such filter specific operations such
> as Insert or Alter
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
