| --- |
| layout: post |
| title: 'Apache Ranger: Policy Model' |
| date: '2022-03-08T00:00:00+00:00' |
| categories: ranger |
| --- |
| <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
|
| <meta name="ProgId" content="Word.Document">
|
| <meta name="Generator" content="Microsoft Word 15">
|
| <meta name="Originator" content="Microsoft Word 15">
|
| <link rel="File-List" href="Apache%20Ranger%20-%20Policy%20Model.fld/filelist.xml">
|
| <link rel="themeData" href="Apache%20Ranger%20-%20Policy%20Model.fld/themedata.thmx">
|
| <link rel="colorSchemeMapping" href="Apache%20Ranger%20-%20Policy%20Model.fld/colorschememapping.xml">
|
| <!--[if gte mso 9]><xml>
|
| <w:WordDocument>
|
| <w:SpellingState>Clean</w:SpellingState>
|
| <w:GrammarState>Clean</w:GrammarState>
|
| <w:TrackMoves>false</w:TrackMoves>
|
| <w:TrackFormatting></w:TrackFormatting>
|
| <w:PunctuationKerning></w:PunctuationKerning>
|
| <w:ValidateAgainstSchemas></w:ValidateAgainstSchemas>
|
| <w:SaveIfXMLInvalid>false</w:SaveIfXMLInvalid>
|
| <w:IgnoreMixedContent>false</w:IgnoreMixedContent>
|
| <w:AlwaysShowPlaceholderText>false</w:AlwaysShowPlaceholderText>
|
| <w:DoNotPromoteQF></w:DoNotPromoteQF>
|
| <w:LidThemeOther>EN-US</w:LidThemeOther>
|
| <w:LidThemeAsian>X-NONE</w:LidThemeAsian>
|
| <w:LidThemeComplexScript>X-NONE</w:LidThemeComplexScript>
|
| <w:Compatibility>
|
| <w:BreakWrappedTables></w:BreakWrappedTables>
|
| <w:SnapToGridInCell></w:SnapToGridInCell>
|
| <w:WrapTextWithPunct></w:WrapTextWithPunct>
|
| <w:UseAsianBreakRules></w:UseAsianBreakRules>
|
| <w:DontGrowAutofit></w:DontGrowAutofit>
|
| <w:SplitPgBreakAndParaMark></w:SplitPgBreakAndParaMark>
|
| <w:EnableOpenTypeKerning></w:EnableOpenTypeKerning>
|
| <w:DontFlipMirrorIndents></w:DontFlipMirrorIndents>
|
| <w:OverrideTableStyleHps></w:OverrideTableStyleHps>
|
| </w:Compatibility>
|
| <w:DoNotOptimizeForBrowser></w:DoNotOptimizeForBrowser>
|
| <m:mathPr>
|
| <m:mathFont m:val="Cambria Math"></m:mathFont>
|
| <m:brkBin m:val="before"></m:brkBin>
|
| <m:brkBinSub m:val="--"></m:brkBinSub>
|
| <m:smallFrac m:val="off"></m:smallFrac>
|
| <m:dispDef></m:dispDef>
|
| <m:lMargin m:val="0"></m:lMargin>
|
| <m:rMargin m:val="0"></m:rMargin>
|
| <m:defJc m:val="centerGroup"></m:defJc>
|
| <m:wrapIndent m:val="1440"></m:wrapIndent>
|
| <m:intLim m:val="subSup"></m:intLim>
|
| <m:naryLim m:val="undOvr"></m:naryLim>
|
| </m:mathPr></w:WordDocument>
|
| </xml><![endif]--><!--[if gte mso 9]><xml>
|
| <w:LatentStyles DefLockedState="false" DefUnhideWhenUsed="false"
|
| DefSemiHidden="false" DefQFormat="false" DefPriority="99"
|
| LatentStyleCount="376">
|
| <w:LsdException Locked="false" Priority="0" QFormat="true" Name="Normal"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 1"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="9" SemiHidden="true"
|
| UnhideWhenUsed="true" QFormat="true" Name="heading 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="9" SemiHidden="true"
|
| UnhideWhenUsed="true" QFormat="true" Name="heading 3"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="9" SemiHidden="true"
|
| UnhideWhenUsed="true" QFormat="true" Name="heading 4"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="9" SemiHidden="true"
|
| UnhideWhenUsed="true" QFormat="true" Name="heading 5"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="9" SemiHidden="true"
|
| UnhideWhenUsed="true" QFormat="true" Name="heading 6"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="9" SemiHidden="true"
|
| UnhideWhenUsed="true" QFormat="true" Name="heading 7"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="9" SemiHidden="true"
|
| UnhideWhenUsed="true" QFormat="true" Name="heading 8"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="9" SemiHidden="true"
|
| UnhideWhenUsed="true" QFormat="true" Name="heading 9"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="index 1"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="index 2"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="index 3"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="index 4"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="index 5"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="index 6"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="index 7"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="index 8"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="index 9"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="39" SemiHidden="true"
|
| UnhideWhenUsed="true" Name="toc 1"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="39" SemiHidden="true"
|
| UnhideWhenUsed="true" Name="toc 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="39" SemiHidden="true"
|
| UnhideWhenUsed="true" Name="toc 3"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="39" SemiHidden="true"
|
| UnhideWhenUsed="true" Name="toc 4"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="39" SemiHidden="true"
|
| UnhideWhenUsed="true" Name="toc 5"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="39" SemiHidden="true"
|
| UnhideWhenUsed="true" Name="toc 6"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="39" SemiHidden="true"
|
| UnhideWhenUsed="true" Name="toc 7"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="39" SemiHidden="true"
|
| UnhideWhenUsed="true" Name="toc 8"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="39" SemiHidden="true"
|
| UnhideWhenUsed="true" Name="toc 9"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Normal Indent"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="footnote text"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="annotation text"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="header"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="footer"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="index heading"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="35" SemiHidden="true"
|
| UnhideWhenUsed="true" QFormat="true" Name="caption"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="table of figures"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="envelope address"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="envelope return"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="footnote reference"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="annotation reference"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="line number"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="page number"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="endnote reference"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="endnote text"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="table of authorities"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="macro"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="toa heading"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="List"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="List Bullet"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="List Number"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="List 2"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="List 3"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="List 4"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="List 5"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="List Bullet 2"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="List Bullet 3"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="List Bullet 4"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="List Bullet 5"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="List Number 2"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="List Number 3"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="List Number 4"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="List Number 5"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="10" QFormat="true" Name="Title"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Closing"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Signature"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="1" SemiHidden="true"
|
| UnhideWhenUsed="true" Name="Default Paragraph Font"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Body Text"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Body Text Indent"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="List Continue"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="List Continue 2"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="List Continue 3"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="List Continue 4"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="List Continue 5"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Message Header"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="11" QFormat="true" Name="Subtitle"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Salutation"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Date"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Body Text First Indent"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Body Text First Indent 2"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Note Heading"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Body Text 2"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Body Text 3"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Body Text Indent 2"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Body Text Indent 3"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Block Text"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Hyperlink"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="FollowedHyperlink"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="22" QFormat="true" Name="Strong"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="20" QFormat="true" Name="Emphasis"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Document Map"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Plain Text"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="E-mail Signature"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="HTML Top of Form"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="HTML Bottom of Form"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Normal (Web)"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="HTML Acronym"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="HTML Address"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="HTML Cite"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="HTML Code"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="HTML Definition"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="HTML Keyboard"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="HTML Preformatted"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="HTML Sample"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="HTML Typewriter"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="HTML Variable"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Normal Table"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="annotation subject"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="No List"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Outline List 1"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Outline List 2"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Outline List 3"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table Simple 1"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table Simple 2"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table Simple 3"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table Classic 1"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table Classic 2"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table Classic 3"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table Classic 4"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table Colorful 1"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table Colorful 2"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table Colorful 3"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table Columns 1"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table Columns 2"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table Columns 3"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table Columns 4"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table Columns 5"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table Grid 1"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table Grid 2"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table Grid 3"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table Grid 4"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table Grid 5"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table Grid 6"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table Grid 7"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table Grid 8"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table List 1"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table List 2"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table List 3"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table List 4"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table List 5"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table List 6"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table List 7"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table List 8"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table 3D effects 1"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table 3D effects 2"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table 3D effects 3"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table Contemporary"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table Elegant"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table Professional"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table Subtle 1"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table Subtle 2"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table Web 1"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table Web 2"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table Web 3"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Balloon Text"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="39" Name="Table Grid"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Table Theme"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" Name="Placeholder Text"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="1" QFormat="true" Name="No Spacing"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="60" Name="Light Shading"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="61" Name="Light List"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="62" Name="Light Grid"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="63" Name="Medium Shading 1"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="64" Name="Medium Shading 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="65" Name="Medium List 1"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="66" Name="Medium List 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="67" Name="Medium Grid 1"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="68" Name="Medium Grid 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="69" Name="Medium Grid 3"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="70" Name="Dark List"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="71" Name="Colorful Shading"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="72" Name="Colorful List"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="73" Name="Colorful Grid"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="60" Name="Light Shading Accent 1"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="61" Name="Light List Accent 1"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="62" Name="Light Grid Accent 1"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="63" Name="Medium Shading 1 Accent 1"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="64" Name="Medium Shading 2 Accent 1"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="65" Name="Medium List 1 Accent 1"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" Name="Revision"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="34" QFormat="true"
|
| Name="List Paragraph"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="29" QFormat="true" Name="Quote"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="30" QFormat="true"
|
| Name="Intense Quote"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="66" Name="Medium List 2 Accent 1"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="67" Name="Medium Grid 1 Accent 1"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="68" Name="Medium Grid 2 Accent 1"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="69" Name="Medium Grid 3 Accent 1"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="70" Name="Dark List Accent 1"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="71" Name="Colorful Shading Accent 1"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="72" Name="Colorful List Accent 1"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="73" Name="Colorful Grid Accent 1"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="60" Name="Light Shading Accent 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="61" Name="Light List Accent 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="62" Name="Light Grid Accent 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="63" Name="Medium Shading 1 Accent 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="64" Name="Medium Shading 2 Accent 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="65" Name="Medium List 1 Accent 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="66" Name="Medium List 2 Accent 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="67" Name="Medium Grid 1 Accent 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="68" Name="Medium Grid 2 Accent 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="69" Name="Medium Grid 3 Accent 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="70" Name="Dark List Accent 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="71" Name="Colorful Shading Accent 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="72" Name="Colorful List Accent 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="73" Name="Colorful Grid Accent 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="60" Name="Light Shading Accent 3"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="61" Name="Light List Accent 3"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="62" Name="Light Grid Accent 3"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="63" Name="Medium Shading 1 Accent 3"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="64" Name="Medium Shading 2 Accent 3"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="65" Name="Medium List 1 Accent 3"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="66" Name="Medium List 2 Accent 3"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="67" Name="Medium Grid 1 Accent 3"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="68" Name="Medium Grid 2 Accent 3"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="69" Name="Medium Grid 3 Accent 3"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="70" Name="Dark List Accent 3"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="71" Name="Colorful Shading Accent 3"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="72" Name="Colorful List Accent 3"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="73" Name="Colorful Grid Accent 3"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="60" Name="Light Shading Accent 4"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="61" Name="Light List Accent 4"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="62" Name="Light Grid Accent 4"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="63" Name="Medium Shading 1 Accent 4"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="64" Name="Medium Shading 2 Accent 4"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="65" Name="Medium List 1 Accent 4"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="66" Name="Medium List 2 Accent 4"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="67" Name="Medium Grid 1 Accent 4"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="68" Name="Medium Grid 2 Accent 4"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="69" Name="Medium Grid 3 Accent 4"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="70" Name="Dark List Accent 4"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="71" Name="Colorful Shading Accent 4"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="72" Name="Colorful List Accent 4"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="73" Name="Colorful Grid Accent 4"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="60" Name="Light Shading Accent 5"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="61" Name="Light List Accent 5"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="62" Name="Light Grid Accent 5"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="63" Name="Medium Shading 1 Accent 5"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="64" Name="Medium Shading 2 Accent 5"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="65" Name="Medium List 1 Accent 5"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="66" Name="Medium List 2 Accent 5"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="67" Name="Medium Grid 1 Accent 5"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="68" Name="Medium Grid 2 Accent 5"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="69" Name="Medium Grid 3 Accent 5"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="70" Name="Dark List Accent 5"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="71" Name="Colorful Shading Accent 5"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="72" Name="Colorful List Accent 5"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="73" Name="Colorful Grid Accent 5"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="60" Name="Light Shading Accent 6"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="61" Name="Light List Accent 6"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="62" Name="Light Grid Accent 6"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="63" Name="Medium Shading 1 Accent 6"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="64" Name="Medium Shading 2 Accent 6"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="65" Name="Medium List 1 Accent 6"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="66" Name="Medium List 2 Accent 6"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="67" Name="Medium Grid 1 Accent 6"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="68" Name="Medium Grid 2 Accent 6"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="69" Name="Medium Grid 3 Accent 6"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="70" Name="Dark List Accent 6"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="71" Name="Colorful Shading Accent 6"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="72" Name="Colorful List Accent 6"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="73" Name="Colorful Grid Accent 6"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="19" QFormat="true"
|
| Name="Subtle Emphasis"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="21" QFormat="true"
|
| Name="Intense Emphasis"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="31" QFormat="true"
|
| Name="Subtle Reference"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="32" QFormat="true"
|
| Name="Intense Reference"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="33" QFormat="true" Name="Book Title"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="37" SemiHidden="true"
|
| UnhideWhenUsed="true" Name="Bibliography"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="39" SemiHidden="true"
|
| UnhideWhenUsed="true" QFormat="true" Name="TOC Heading"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="41" Name="Plain Table 1"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="42" Name="Plain Table 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="43" Name="Plain Table 3"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="44" Name="Plain Table 4"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="45" Name="Plain Table 5"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="40" Name="Grid Table Light"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="46" Name="Grid Table 1 Light"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="47" Name="Grid Table 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="48" Name="Grid Table 3"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="49" Name="Grid Table 4"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="50" Name="Grid Table 5 Dark"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="51" Name="Grid Table 6 Colorful"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="52" Name="Grid Table 7 Colorful"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="46"
|
| Name="Grid Table 1 Light Accent 1"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="47" Name="Grid Table 2 Accent 1"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="48" Name="Grid Table 3 Accent 1"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="49" Name="Grid Table 4 Accent 1"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="50" Name="Grid Table 5 Dark Accent 1"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="51"
|
| Name="Grid Table 6 Colorful Accent 1"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="52"
|
| Name="Grid Table 7 Colorful Accent 1"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="46"
|
| Name="Grid Table 1 Light Accent 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="47" Name="Grid Table 2 Accent 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="48" Name="Grid Table 3 Accent 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="49" Name="Grid Table 4 Accent 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="50" Name="Grid Table 5 Dark Accent 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="51"
|
| Name="Grid Table 6 Colorful Accent 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="52"
|
| Name="Grid Table 7 Colorful Accent 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="46"
|
| Name="Grid Table 1 Light Accent 3"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="47" Name="Grid Table 2 Accent 3"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="48" Name="Grid Table 3 Accent 3"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="49" Name="Grid Table 4 Accent 3"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="50" Name="Grid Table 5 Dark Accent 3"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="51"
|
| Name="Grid Table 6 Colorful Accent 3"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="52"
|
| Name="Grid Table 7 Colorful Accent 3"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="46"
|
| Name="Grid Table 1 Light Accent 4"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="47" Name="Grid Table 2 Accent 4"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="48" Name="Grid Table 3 Accent 4"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="49" Name="Grid Table 4 Accent 4"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="50" Name="Grid Table 5 Dark Accent 4"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="51"
|
| Name="Grid Table 6 Colorful Accent 4"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="52"
|
| Name="Grid Table 7 Colorful Accent 4"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="46"
|
| Name="Grid Table 1 Light Accent 5"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="47" Name="Grid Table 2 Accent 5"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="48" Name="Grid Table 3 Accent 5"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="49" Name="Grid Table 4 Accent 5"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="50" Name="Grid Table 5 Dark Accent 5"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="51"
|
| Name="Grid Table 6 Colorful Accent 5"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="52"
|
| Name="Grid Table 7 Colorful Accent 5"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="46"
|
| Name="Grid Table 1 Light Accent 6"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="47" Name="Grid Table 2 Accent 6"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="48" Name="Grid Table 3 Accent 6"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="49" Name="Grid Table 4 Accent 6"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="50" Name="Grid Table 5 Dark Accent 6"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="51"
|
| Name="Grid Table 6 Colorful Accent 6"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="52"
|
| Name="Grid Table 7 Colorful Accent 6"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="46" Name="List Table 1 Light"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="47" Name="List Table 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="48" Name="List Table 3"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="49" Name="List Table 4"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="50" Name="List Table 5 Dark"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="51" Name="List Table 6 Colorful"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="52" Name="List Table 7 Colorful"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="46"
|
| Name="List Table 1 Light Accent 1"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="47" Name="List Table 2 Accent 1"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="48" Name="List Table 3 Accent 1"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="49" Name="List Table 4 Accent 1"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="50" Name="List Table 5 Dark Accent 1"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="51"
|
| Name="List Table 6 Colorful Accent 1"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="52"
|
| Name="List Table 7 Colorful Accent 1"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="46"
|
| Name="List Table 1 Light Accent 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="47" Name="List Table 2 Accent 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="48" Name="List Table 3 Accent 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="49" Name="List Table 4 Accent 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="50" Name="List Table 5 Dark Accent 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="51"
|
| Name="List Table 6 Colorful Accent 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="52"
|
| Name="List Table 7 Colorful Accent 2"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="46"
|
| Name="List Table 1 Light Accent 3"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="47" Name="List Table 2 Accent 3"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="48" Name="List Table 3 Accent 3"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="49" Name="List Table 4 Accent 3"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="50" Name="List Table 5 Dark Accent 3"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="51"
|
| Name="List Table 6 Colorful Accent 3"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="52"
|
| Name="List Table 7 Colorful Accent 3"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="46"
|
| Name="List Table 1 Light Accent 4"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="47" Name="List Table 2 Accent 4"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="48" Name="List Table 3 Accent 4"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="49" Name="List Table 4 Accent 4"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="50" Name="List Table 5 Dark Accent 4"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="51"
|
| Name="List Table 6 Colorful Accent 4"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="52"
|
| Name="List Table 7 Colorful Accent 4"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="46"
|
| Name="List Table 1 Light Accent 5"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="47" Name="List Table 2 Accent 5"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="48" Name="List Table 3 Accent 5"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="49" Name="List Table 4 Accent 5"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="50" Name="List Table 5 Dark Accent 5"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="51"
|
| Name="List Table 6 Colorful Accent 5"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="52"
|
| Name="List Table 7 Colorful Accent 5"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="46"
|
| Name="List Table 1 Light Accent 6"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="47" Name="List Table 2 Accent 6"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="48" Name="List Table 3 Accent 6"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="49" Name="List Table 4 Accent 6"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="50" Name="List Table 5 Dark Accent 6"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="51"
|
| Name="List Table 6 Colorful Accent 6"></w:LsdException>
|
| <w:LsdException Locked="false" Priority="52"
|
| Name="List Table 7 Colorful Accent 6"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Mention"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Smart Hyperlink"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Hashtag"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Unresolved Mention"></w:LsdException>
|
| <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true"
|
| Name="Smart Link"></w:LsdException>
|
| </w:LatentStyles>
|
| </xml><![endif]-->
|
| <style>
|
| <!--
|
| /* Font Definitions */
|
| @font-face
|
| {font-family:"Cambria Math";
|
| panose-1:2 4 5 3 5 4 6 3 2 4;
|
| mso-font-charset:0;
|
| mso-generic-font-family:roman;
|
| mso-font-pitch:variable;
|
| mso-font-signature:3 0 0 0 1 0;}
|
| @font-face
|
| {font-family:Calibri;
|
| panose-1:2 15 5 2 2 2 4 3 2 4;
|
| mso-font-charset:0;
|
| mso-generic-font-family:swiss;
|
| mso-font-pitch:variable;
|
| mso-font-signature:-536859905 -1073732485 9 0 511 0;}
|
| @font-face
|
| {font-family:Georgia;
|
| panose-1:2 4 5 2 5 4 5 2 3 3;
|
| mso-font-charset:0;
|
| mso-generic-font-family:roman;
|
| mso-font-pitch:variable;
|
| mso-font-signature:647 0 0 0 159 0;}
|
| @font-face
|
| {font-family:"Noto Sans Symbols";
|
| panose-1:2 11 6 4 2 2 2 2 2 4;
|
| mso-font-charset:0;
|
| mso-generic-font-family:auto;
|
| mso-font-pitch:auto;
|
| mso-font-signature:0 0 0 0 0 0;}
|
| /* Style Definitions */
|
| p.MsoNormal, li.MsoNormal, div.MsoNormal
|
| {mso-style-unhide:no;
|
| mso-style-qformat:yes;
|
| mso-style-parent:"";
|
| margin:0in;
|
| mso-pagination:widow-orphan;
|
| font-size:12.0pt;
|
| font-family:"Calibri",sans-serif;
|
| mso-fareast-font-family:Calibri;}
|
| h1
|
| {mso-style-priority:9;
|
| mso-style-unhide:no;
|
| mso-style-qformat:yes;
|
| mso-style-next:Normal;
|
| margin-top:12.0pt;
|
| margin-right:0in;
|
| margin-bottom:0in;
|
| margin-left:0in;
|
| mso-pagination:widow-orphan lines-together;
|
| page-break-after:avoid;
|
| mso-outline-level:1;
|
| font-size:16.0pt;
|
| font-family:"Calibri",sans-serif;
|
| color:#2F5496;
|
| mso-font-kerning:0pt;
|
| font-weight:normal;}
|
| h2
|
| {mso-style-priority:9;
|
| mso-style-qformat:yes;
|
| mso-style-next:Normal;
|
| margin-top:2.0pt;
|
| margin-right:0in;
|
| margin-bottom:0in;
|
| margin-left:0in;
|
| mso-pagination:widow-orphan lines-together;
|
| page-break-after:avoid;
|
| mso-outline-level:2;
|
| font-size:13.0pt;
|
| font-family:"Calibri",sans-serif;
|
| color:#2F5496;
|
| font-weight:normal;}
|
| h3
|
| {mso-style-noshow:yes;
|
| mso-style-priority:9;
|
| mso-style-qformat:yes;
|
| mso-style-next:Normal;
|
| margin-top:14.0pt;
|
| margin-right:0in;
|
| margin-bottom:4.0pt;
|
| margin-left:0in;
|
| mso-pagination:widow-orphan lines-together;
|
| page-break-after:avoid;
|
| mso-outline-level:3;
|
| font-size:14.0pt;
|
| font-family:"Calibri",sans-serif;
|
| mso-bidi-font-weight:normal;}
|
| h4
|
| {mso-style-noshow:yes;
|
| mso-style-priority:9;
|
| mso-style-qformat:yes;
|
| mso-style-next:Normal;
|
| margin-top:12.0pt;
|
| margin-right:0in;
|
| margin-bottom:2.0pt;
|
| margin-left:0in;
|
| mso-pagination:widow-orphan lines-together;
|
| page-break-after:avoid;
|
| mso-outline-level:4;
|
| font-size:12.0pt;
|
| font-family:"Calibri",sans-serif;
|
| mso-bidi-font-weight:normal;}
|
| h5
|
| {mso-style-noshow:yes;
|
| mso-style-priority:9;
|
| mso-style-qformat:yes;
|
| mso-style-next:Normal;
|
| margin-top:11.0pt;
|
| margin-right:0in;
|
| margin-bottom:2.0pt;
|
| margin-left:0in;
|
| mso-pagination:widow-orphan lines-together;
|
| page-break-after:avoid;
|
| mso-outline-level:5;
|
| font-size:11.0pt;
|
| font-family:"Calibri",sans-serif;
|
| mso-bidi-font-weight:normal;}
|
| h6
|
| {mso-style-noshow:yes;
|
| mso-style-priority:9;
|
| mso-style-qformat:yes;
|
| mso-style-next:Normal;
|
| margin-top:10.0pt;
|
| margin-right:0in;
|
| margin-bottom:2.0pt;
|
| margin-left:0in;
|
| mso-pagination:widow-orphan lines-together;
|
| page-break-after:avoid;
|
| mso-outline-level:6;
|
| font-size:10.0pt;
|
| font-family:"Calibri",sans-serif;
|
| mso-bidi-font-weight:normal;}
|
| p.MsoToc1, li.MsoToc1, div.MsoToc1
|
| {mso-style-update:auto;
|
| mso-style-priority:39;
|
| mso-style-next:Normal;
|
| margin-top:0in;
|
| margin-right:0in;
|
| margin-bottom:5.0pt;
|
| margin-left:0in;
|
| mso-pagination:widow-orphan;
|
| font-size:12.0pt;
|
| font-family:"Calibri",sans-serif;
|
| mso-fareast-font-family:Calibri;}
|
| p.MsoToc2, li.MsoToc2, div.MsoToc2
|
| {mso-style-update:auto;
|
| mso-style-priority:39;
|
| mso-style-next:Normal;
|
| margin-top:0in;
|
| margin-right:0in;
|
| margin-bottom:5.0pt;
|
| margin-left:12.0pt;
|
| mso-pagination:widow-orphan;
|
| font-size:12.0pt;
|
| font-family:"Calibri",sans-serif;
|
| mso-fareast-font-family:Calibri;}
|
| p.MsoTitle, li.MsoTitle, div.MsoTitle
|
| {mso-style-priority:10;
|
| mso-style-unhide:no;
|
| mso-style-qformat:yes;
|
| mso-style-next:Normal;
|
| margin-top:24.0pt;
|
| margin-right:0in;
|
| margin-bottom:6.0pt;
|
| margin-left:0in;
|
| mso-pagination:widow-orphan lines-together;
|
| page-break-after:avoid;
|
| font-size:36.0pt;
|
| font-family:"Calibri",sans-serif;
|
| mso-fareast-font-family:Calibri;
|
| font-weight:bold;
|
| mso-bidi-font-weight:normal;}
|
| p.MsoSubtitle, li.MsoSubtitle, div.MsoSubtitle
|
| {mso-style-priority:11;
|
| mso-style-unhide:no;
|
| mso-style-qformat:yes;
|
| mso-style-next:Normal;
|
| margin-top:.25in;
|
| margin-right:0in;
|
| margin-bottom:4.0pt;
|
| margin-left:0in;
|
| mso-pagination:widow-orphan lines-together;
|
| page-break-after:avoid;
|
| font-size:24.0pt;
|
| font-family:"Georgia",serif;
|
| mso-fareast-font-family:Georgia;
|
| mso-bidi-font-family:Georgia;
|
| color:#666666;
|
| font-style:italic;
|
| mso-bidi-font-style:normal;}
|
| a:link, span.MsoHyperlink
|
| {mso-style-priority:99;
|
| color:blue;
|
| mso-themecolor:hyperlink;
|
| text-decoration:underline;
|
| text-underline:single;}
|
| a:visited, span.MsoHyperlinkFollowed
|
| {mso-style-noshow:yes;
|
| mso-style-priority:99;
|
| color:purple;
|
| mso-themecolor:followedhyperlink;
|
| text-decoration:underline;
|
| text-underline:single;}
|
| span.SpellE
|
| {mso-style-name:"";
|
| mso-spl-e:yes;}
|
| span.GramE
|
| {mso-style-name:"";
|
| mso-gram-e:yes;}
|
| .MsoChpDefault
|
| {mso-style-type:export-only;
|
| mso-default-props:yes;
|
| font-family:"Calibri",sans-serif;
|
| mso-ascii-font-family:Calibri;
|
| mso-fareast-font-family:Calibri;
|
| mso-hansi-font-family:Calibri;
|
| mso-bidi-font-family:Calibri;}
|
| /* Page Definitions */
|
| @page
|
| {mso-footnote-separator:url("Apache%20Ranger%20-%20Policy%20Model.fld/header.html") fs;
|
| mso-footnote-continuation-separator:url("Apache%20Ranger%20-%20Policy%20Model.fld/header.html") fcs;
|
| mso-endnote-separator:url("Apache%20Ranger%20-%20Policy%20Model.fld/header.html") es;
|
| mso-endnote-continuation-separator:url("Apache%20Ranger%20-%20Policy%20Model.fld/header.html") ecs;}
|
| @page WordSection1
|
| {size:8.5in 11.0in;
|
| margin:1.0in 1.0in 1.0in 1.0in;
|
| mso-header-margin:.5in;
|
| mso-footer-margin:.5in;
|
| mso-page-numbers:1;
|
| mso-header:url("Apache%20Ranger%20-%20Policy%20Model.fld/header.html") h1;
|
| mso-footer:url("Apache%20Ranger%20-%20Policy%20Model.fld/header.html") f1;
|
| mso-paper-source:0;}
|
| div.WordSection1
|
| {page:WordSection1;}
|
| /* List Definitions */
|
| @list l0
|
| {mso-list-id:493883153;
|
| mso-list-template-ids:1867660220;}
|
| @list l0:level1
|
| {mso-level-start-at:0;
|
| mso-level-number-format:bullet;
|
| mso-level-text:-;
|
| mso-level-tab-stop:none;
|
| mso-level-number-position:left;
|
| text-indent:-.25in;
|
| mso-ascii-font-family:Calibri;
|
| mso-fareast-font-family:Calibri;
|
| mso-hansi-font-family:Calibri;
|
| mso-bidi-font-family:Calibri;}
|
| @list l0:level2
|
| {mso-level-number-format:bullet;
|
| mso-level-text:o;
|
| mso-level-tab-stop:none;
|
| mso-level-number-position:left;
|
| text-indent:-.25in;
|
| mso-ascii-font-family:"Courier New";
|
| mso-fareast-font-family:"Courier New";
|
| mso-hansi-font-family:"Courier New";
|
| mso-bidi-font-family:"Courier New";}
|
| @list l0:level3
|
| {mso-level-number-format:bullet;
|
| mso-level-text:▪;
|
| mso-level-tab-stop:none;
|
| mso-level-number-position:left;
|
| text-indent:-.25in;
|
| mso-ascii-font-family:"Noto Sans Symbols";
|
| mso-fareast-font-family:"Noto Sans Symbols";
|
| mso-hansi-font-family:"Noto Sans Symbols";
|
| mso-bidi-font-family:"Noto Sans Symbols";}
|
| @list l0:level4
|
| {mso-level-number-format:bullet;
|
| mso-level-text:●;
|
| mso-level-tab-stop:none;
|
| mso-level-number-position:left;
|
| text-indent:-.25in;
|
| mso-ascii-font-family:"Noto Sans Symbols";
|
| mso-fareast-font-family:"Noto Sans Symbols";
|
| mso-hansi-font-family:"Noto Sans Symbols";
|
| mso-bidi-font-family:"Noto Sans Symbols";}
|
| @list l0:level5
|
| {mso-level-number-format:bullet;
|
| mso-level-text:o;
|
| mso-level-tab-stop:none;
|
| mso-level-number-position:left;
|
| text-indent:-.25in;
|
| mso-ascii-font-family:"Courier New";
|
| mso-fareast-font-family:"Courier New";
|
| mso-hansi-font-family:"Courier New";
|
| mso-bidi-font-family:"Courier New";}
|
| @list l0:level6
|
| {mso-level-number-format:bullet;
|
| mso-level-text:▪;
|
| mso-level-tab-stop:none;
|
| mso-level-number-position:left;
|
| text-indent:-.25in;
|
| mso-ascii-font-family:"Noto Sans Symbols";
|
| mso-fareast-font-family:"Noto Sans Symbols";
|
| mso-hansi-font-family:"Noto Sans Symbols";
|
| mso-bidi-font-family:"Noto Sans Symbols";}
|
| @list l0:level7
|
| {mso-level-number-format:bullet;
|
| mso-level-text:●;
|
| mso-level-tab-stop:none;
|
| mso-level-number-position:left;
|
| text-indent:-.25in;
|
| mso-ascii-font-family:"Noto Sans Symbols";
|
| mso-fareast-font-family:"Noto Sans Symbols";
|
| mso-hansi-font-family:"Noto Sans Symbols";
|
| mso-bidi-font-family:"Noto Sans Symbols";}
|
| @list l0:level8
|
| {mso-level-number-format:bullet;
|
| mso-level-text:o;
|
| mso-level-tab-stop:none;
|
| mso-level-number-position:left;
|
| text-indent:-.25in;
|
| mso-ascii-font-family:"Courier New";
|
| mso-fareast-font-family:"Courier New";
|
| mso-hansi-font-family:"Courier New";
|
| mso-bidi-font-family:"Courier New";}
|
| @list l0:level9
|
| {mso-level-number-format:bullet;
|
| mso-level-text:▪;
|
| mso-level-tab-stop:none;
|
| mso-level-number-position:left;
|
| text-indent:-.25in;
|
| mso-ascii-font-family:"Noto Sans Symbols";
|
| mso-fareast-font-family:"Noto Sans Symbols";
|
| mso-hansi-font-family:"Noto Sans Symbols";
|
| mso-bidi-font-family:"Noto Sans Symbols";}
|
| @list l1
|
| {mso-list-id:528031275;
|
| mso-list-template-ids:500091066;}
|
| @list l1:level1
|
| {mso-level-start-at:0;
|
| mso-level-number-format:bullet;
|
| mso-level-text:-;
|
| mso-level-tab-stop:none;
|
| mso-level-number-position:left;
|
| text-indent:-.25in;
|
| mso-ascii-font-family:Calibri;
|
| mso-fareast-font-family:Calibri;
|
| mso-hansi-font-family:Calibri;
|
| mso-bidi-font-family:Calibri;}
|
| @list l1:level2
|
| {mso-level-number-format:bullet;
|
| mso-level-text:o;
|
| mso-level-tab-stop:none;
|
| mso-level-number-position:left;
|
| text-indent:-.25in;
|
| mso-ascii-font-family:"Courier New";
|
| mso-fareast-font-family:"Courier New";
|
| mso-hansi-font-family:"Courier New";
|
| mso-bidi-font-family:"Courier New";}
|
| @list l1:level3
|
| {mso-level-number-format:bullet;
|
| mso-level-text:▪;
|
| mso-level-tab-stop:none;
|
| mso-level-number-position:left;
|
| text-indent:-.25in;
|
| mso-ascii-font-family:"Noto Sans Symbols";
|
| mso-fareast-font-family:"Noto Sans Symbols";
|
| mso-hansi-font-family:"Noto Sans Symbols";
|
| mso-bidi-font-family:"Noto Sans Symbols";}
|
| @list l1:level4
|
| {mso-level-number-format:bullet;
|
| mso-level-text:●;
|
| mso-level-tab-stop:none;
|
| mso-level-number-position:left;
|
| text-indent:-.25in;
|
| mso-ascii-font-family:"Noto Sans Symbols";
|
| mso-fareast-font-family:"Noto Sans Symbols";
|
| mso-hansi-font-family:"Noto Sans Symbols";
|
| mso-bidi-font-family:"Noto Sans Symbols";}
|
| @list l1:level5
|
| {mso-level-number-format:bullet;
|
| mso-level-text:o;
|
| mso-level-tab-stop:none;
|
| mso-level-number-position:left;
|
| text-indent:-.25in;
|
| mso-ascii-font-family:"Courier New";
|
| mso-fareast-font-family:"Courier New";
|
| mso-hansi-font-family:"Courier New";
|
| mso-bidi-font-family:"Courier New";}
|
| @list l1:level6
|
| {mso-level-number-format:bullet;
|
| mso-level-text:▪;
|
| mso-level-tab-stop:none;
|
| mso-level-number-position:left;
|
| text-indent:-.25in;
|
| mso-ascii-font-family:"Noto Sans Symbols";
|
| mso-fareast-font-family:"Noto Sans Symbols";
|
| mso-hansi-font-family:"Noto Sans Symbols";
|
| mso-bidi-font-family:"Noto Sans Symbols";}
|
| @list l1:level7
|
| {mso-level-number-format:bullet;
|
| mso-level-text:●;
|
| mso-level-tab-stop:none;
|
| mso-level-number-position:left;
|
| text-indent:-.25in;
|
| mso-ascii-font-family:"Noto Sans Symbols";
|
| mso-fareast-font-family:"Noto Sans Symbols";
|
| mso-hansi-font-family:"Noto Sans Symbols";
|
| mso-bidi-font-family:"Noto Sans Symbols";}
|
| @list l1:level8
|
| {mso-level-number-format:bullet;
|
| mso-level-text:o;
|
| mso-level-tab-stop:none;
|
| mso-level-number-position:left;
|
| text-indent:-.25in;
|
| mso-ascii-font-family:"Courier New";
|
| mso-fareast-font-family:"Courier New";
|
| mso-hansi-font-family:"Courier New";
|
| mso-bidi-font-family:"Courier New";}
|
| @list l1:level9
|
| {mso-level-number-format:bullet;
|
| mso-level-text:▪;
|
| mso-level-tab-stop:none;
|
| mso-level-number-position:left;
|
| text-indent:-.25in;
|
| mso-ascii-font-family:"Noto Sans Symbols";
|
| mso-fareast-font-family:"Noto Sans Symbols";
|
| mso-hansi-font-family:"Noto Sans Symbols";
|
| mso-bidi-font-family:"Noto Sans Symbols";}
|
| @list l2
|
| {mso-list-id:1738938972;
|
| mso-list-template-ids:-698691296;}
|
| @list l2:level1
|
| {mso-level-number-format:bullet;
|
| mso-level-text:-;
|
| mso-level-tab-stop:none;
|
| mso-level-number-position:left;
|
| text-indent:-.25in;
|
| text-decoration:none;
|
| text-underline:none;}
|
| @list l2:level2
|
| {mso-level-number-format:bullet;
|
| mso-level-text:-;
|
| mso-level-tab-stop:none;
|
| mso-level-number-position:left;
|
| text-indent:-.25in;
|
| text-decoration:none;
|
| text-underline:none;}
|
| @list l2:level3
|
| {mso-level-number-format:bullet;
|
| mso-level-text:-;
|
| mso-level-tab-stop:none;
|
| mso-level-number-position:left;
|
| text-indent:-.25in;
|
| text-decoration:none;
|
| text-underline:none;}
|
| @list l2:level4
|
| {mso-level-number-format:bullet;
|
| mso-level-text:-;
|
| mso-level-tab-stop:none;
|
| mso-level-number-position:left;
|
| text-indent:-.25in;
|
| text-decoration:none;
|
| text-underline:none;}
|
| @list l2:level5
|
| {mso-level-number-format:bullet;
|
| mso-level-text:-;
|
| mso-level-tab-stop:none;
|
| mso-level-number-position:left;
|
| text-indent:-.25in;
|
| text-decoration:none;
|
| text-underline:none;}
|
| @list l2:level6
|
| {mso-level-number-format:bullet;
|
| mso-level-text:-;
|
| mso-level-tab-stop:none;
|
| mso-level-number-position:left;
|
| text-indent:-.25in;
|
| text-decoration:none;
|
| text-underline:none;}
|
| @list l2:level7
|
| {mso-level-number-format:bullet;
|
| mso-level-text:-;
|
| mso-level-tab-stop:none;
|
| mso-level-number-position:left;
|
| text-indent:-.25in;
|
| text-decoration:none;
|
| text-underline:none;}
|
| @list l2:level8
|
| {mso-level-number-format:bullet;
|
| mso-level-text:-;
|
| mso-level-tab-stop:none;
|
| mso-level-number-position:left;
|
| text-indent:-.25in;
|
| text-decoration:none;
|
| text-underline:none;}
|
| @list l2:level9
|
| {mso-level-number-format:bullet;
|
| mso-level-text:-;
|
| mso-level-tab-stop:none;
|
| mso-level-number-position:left;
|
| text-indent:-.25in;
|
| text-decoration:none;
|
| text-underline:none;}
|
| ol
|
| {margin-bottom:0in;}
|
| ul
|
| {margin-bottom:0in;}
|
| -->
|
| </style>
|
| <!--[if gte mso 10]>
|
| <style>
|
| /* Style Definitions */
|
| table.MsoNormalTable
|
| {mso-style-name:"Table Normal";
|
| mso-tstyle-rowband-size:0;
|
| mso-tstyle-colband-size:0;
|
| mso-style-noshow:yes;
|
| mso-style-priority:99;
|
| mso-style-parent:"";
|
| mso-padding-alt:0in 5.4pt 0in 5.4pt;
|
| mso-para-margin:0in;
|
| mso-pagination:widow-orphan;
|
| font-size:12.0pt;
|
| font-family:"Calibri",sans-serif;}
|
| table.a
|
| {mso-style-name:"";
|
| mso-tstyle-rowband-size:1;
|
| mso-tstyle-colband-size:1;
|
| mso-style-unhide:no;
|
| mso-padding-alt:0in 5.4pt 0in 5.4pt;
|
| mso-para-margin:0in;
|
| mso-pagination:widow-orphan;
|
| font-size:12.0pt;
|
| font-family:"Calibri",sans-serif;}
|
| table.a0
|
| {mso-style-name:"";
|
| mso-tstyle-rowband-size:1;
|
| mso-tstyle-colband-size:1;
|
| mso-style-unhide:no;
|
| mso-padding-alt:0in 5.4pt 0in 5.4pt;
|
| mso-para-margin:0in;
|
| mso-pagination:widow-orphan;
|
| font-size:12.0pt;
|
| font-family:"Calibri",sans-serif;}
|
| table.a1
|
| {mso-style-name:"";
|
| mso-tstyle-rowband-size:1;
|
| mso-tstyle-colband-size:1;
|
| mso-style-unhide:no;
|
| mso-padding-alt:0in 5.4pt 0in 5.4pt;
|
| mso-para-margin:0in;
|
| mso-pagination:widow-orphan;
|
| font-size:12.0pt;
|
| font-family:"Calibri",sans-serif;}
|
| table.a2
|
| {mso-style-name:"";
|
| mso-tstyle-rowband-size:1;
|
| mso-tstyle-colband-size:1;
|
| mso-style-unhide:no;
|
| mso-padding-alt:5.0pt 5.0pt 5.0pt 5.0pt;
|
| mso-para-margin:0in;
|
| mso-pagination:widow-orphan;
|
| font-size:12.0pt;
|
| font-family:"Calibri",sans-serif;}
|
| table.a3
|
| {mso-style-name:"";
|
| mso-tstyle-rowband-size:1;
|
| mso-tstyle-colband-size:1;
|
| mso-style-unhide:no;
|
| mso-padding-alt:5.0pt 5.0pt 5.0pt 5.0pt;
|
| mso-para-margin:0in;
|
| mso-pagination:widow-orphan;
|
| font-size:12.0pt;
|
| font-family:"Calibri",sans-serif;}
|
| table.a4
|
| {mso-style-name:"";
|
| mso-tstyle-rowband-size:1;
|
| mso-tstyle-colband-size:1;
|
| mso-style-unhide:no;
|
| mso-padding-alt:5.0pt 5.0pt 5.0pt 5.0pt;
|
| mso-para-margin:0in;
|
| mso-pagination:widow-orphan;
|
| font-size:12.0pt;
|
| font-family:"Calibri",sans-serif;}
|
| table.a5
|
| {mso-style-name:"";
|
| mso-tstyle-rowband-size:1;
|
| mso-tstyle-colband-size:1;
|
| mso-style-unhide:no;
|
| mso-padding-alt:5.0pt 5.0pt 5.0pt 5.0pt;
|
| mso-para-margin:0in;
|
| mso-pagination:widow-orphan;
|
| font-size:12.0pt;
|
| font-family:"Calibri",sans-serif;}
|
| table.a6
|
| {mso-style-name:"";
|
| mso-tstyle-rowband-size:1;
|
| mso-tstyle-colband-size:1;
|
| mso-style-unhide:no;
|
| mso-padding-alt:5.0pt 5.0pt 5.0pt 5.0pt;
|
| mso-para-margin:0in;
|
| mso-pagination:widow-orphan;
|
| font-size:12.0pt;
|
| font-family:"Calibri",sans-serif;}
|
| table.a7
|
| {mso-style-name:"";
|
| mso-tstyle-rowband-size:1;
|
| mso-tstyle-colband-size:1;
|
| mso-style-unhide:no;
|
| mso-padding-alt:5.0pt 5.0pt 5.0pt 5.0pt;
|
| mso-para-margin:0in;
|
| mso-pagination:widow-orphan;
|
| font-size:12.0pt;
|
| font-family:"Calibri",sans-serif;}
|
| table.a8
|
| {mso-style-name:"";
|
| mso-tstyle-rowband-size:1;
|
| mso-tstyle-colband-size:1;
|
| mso-style-unhide:no;
|
| mso-padding-alt:0in 5.4pt 0in 5.4pt;
|
| mso-para-margin:0in;
|
| mso-pagination:widow-orphan;
|
| font-size:12.0pt;
|
| font-family:"Calibri",sans-serif;}
|
| table.a9
|
| {mso-style-name:"";
|
| mso-tstyle-rowband-size:1;
|
| mso-tstyle-colband-size:1;
|
| mso-style-unhide:no;
|
| mso-padding-alt:0in 5.4pt 0in 5.4pt;
|
| mso-para-margin:0in;
|
| mso-pagination:widow-orphan;
|
| font-size:12.0pt;
|
| font-family:"Calibri",sans-serif;}
|
| table.aa
|
| {mso-style-name:"";
|
| mso-tstyle-rowband-size:1;
|
| mso-tstyle-colband-size:1;
|
| mso-style-unhide:no;
|
| mso-padding-alt:0in 5.4pt 0in 5.4pt;
|
| mso-para-margin:0in;
|
| mso-pagination:widow-orphan;
|
| font-size:12.0pt;
|
| font-family:"Calibri",sans-serif;}
|
| table.ab
|
| {mso-style-name:"";
|
| mso-tstyle-rowband-size:1;
|
| mso-tstyle-colband-size:1;
|
| mso-style-unhide:no;
|
| mso-padding-alt:0in 5.4pt 0in 5.4pt;
|
| mso-para-margin:0in;
|
| mso-pagination:widow-orphan;
|
| font-size:12.0pt;
|
| font-family:"Calibri",sans-serif;}
|
| table.ac
|
| {mso-style-name:"";
|
| mso-tstyle-rowband-size:1;
|
| mso-tstyle-colband-size:1;
|
| mso-style-unhide:no;
|
| mso-padding-alt:0in 5.4pt 0in 5.4pt;
|
| mso-para-margin:0in;
|
| mso-pagination:widow-orphan;
|
| font-size:12.0pt;
|
| font-family:"Calibri",sans-serif;}
|
| </style>
|
| <![endif]-->
|
|
|
|
|
|
|
|
|
| <div class="WordSection1">
|
|
|
| <p class="MsoNormal" align="center" style="text-align:center"><span style="font-size:36.0pt"></span></p>
|
|
|
| <p class="MsoNormal" align="center" style="text-align:center"><span style="font-size:36.0pt"></span></p>
|
|
|
| <p dir="ltr" style="line-height:1.2;text-align: center;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:36pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Apache Ranger: Policy Model</span></p><p dir="ltr" style="text-align: left; line-height: 1.2; margin-top: 0pt; margin-bottom: 0pt;"><span style="font-size: 18px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;"><br></span></p><p dir="ltr" style="text-align: right; line-height: 1.2; margin-top: 0pt; margin-bottom: 0pt;"><span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"> Madhan Neethiraj </span></p><p dir="ltr" style="text-align: right; line-height: 1.2; margin-top: 0pt; margin-bottom: 0pt;">2022-March-07 <span style="background-color: transparent; font-family: Calibri, sans-serif; font-size: 18px; white-space: pre-wrap;"> </span><br></p><p dir="ltr" style="text-align: right; line-height: 1.2; margin-top: 0pt; margin-bottom: 0pt;"><span style="font-size: 18px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;"><br></span></p><p dir="ltr" style="text-align: left; line-height: 1.2; margin-top: 0pt; margin-bottom: 0pt;"><span style="font-size: 18px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;"><br></span></p>
|
| <p dir="ltr" style="margin-top: 0pt; margin-right: 27pt; margin-bottom: 0pt; line-height: 1.2;"><span style="background-color: transparent; color: rgb(47, 84, 150); font-family: Calibri, sans-serif; font-size: 16pt; white-space: pre-wrap;">Introduction</span></p><p dir="ltr" style="margin-top: 0pt; margin-right: 27pt; margin-bottom: 0pt; line-height: 1.2;"><span style="background-color: transparent; font-size: 16pt; white-space: pre-wrap; color: rgb(47, 84, 150); font-family: Calibri, sans-serif;">Policy Model</span></p><p dir="ltr" style="margin-top: 0pt; margin-right: 27pt; margin-bottom: 0pt; line-height: 1.2;"><span style="color: rgb(47, 84, 150); font-family: Calibri, sans-serif; font-size: 13pt;"> </span><span style="color: rgb(47, 84, 150); font-family: Calibri, sans-serif; font-size: 13pt; background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;">Resources</span><br></p><p dir="ltr" style="margin-top: 0pt; margin-right: 27pt; margin-bottom: 0pt; line-height: 1.2;"><span style="color: rgb(47, 84, 150); font-family: Calibri, sans-serif; font-size: 13pt;"> </span><span style="color: rgb(47, 84, 150); font-family: Calibri, sans-serif; font-size: 13pt; background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;">Permissions</span><br></p><p dir="ltr" style="margin-top: 0pt; margin-right: 27pt; margin-bottom: 0pt; line-height: 1.2;"><span style="color: rgb(47, 84, 150); font-family: Calibri, sans-serif; font-size: 13pt;"> </span><span style="color: rgb(47, 84, 150); font-family: Calibri, sans-serif; font-size: 13pt; background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;">Users, Groups, Roles</span><br></p><p dir="ltr" style="margin-top: 0pt; margin-right: 27pt; margin-bottom: 0pt; line-height: 1.2;"><span style="color: rgb(47, 84, 150); font-family: Calibri, sans-serif; font-size: 13pt;"> </span><span style="color: rgb(47, 84, 150); font-family: Calibri, sans-serif; font-size: 13pt; background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;">Security Zones</span><br></p><p dir="ltr" style="margin-top: 0pt; margin-right: 27pt; margin-bottom: 0pt; line-height: 1.2;"><span style="color: rgb(47, 84, 150); font-family: Calibri, sans-serif; font-size: 13pt;"> </span><span style="color: rgb(47, 84, 150); font-family: Calibri, sans-serif; font-size: 13pt; background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;">Allow, Deny, Exceptions</span><br></p><p dir="ltr" style="margin-top: 0pt; margin-right: 27pt; margin-bottom: 0pt; line-height: 1.2;"><span style="color: rgb(47, 84, 150); font-family: Calibri, sans-serif; font-size: 13pt;"> </span><span style="color: rgb(47, 84, 150); font-family: Calibri, sans-serif; font-size: 13pt; background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;">Wildcards, macros, variables in resource names</span><br></p><p dir="ltr" style="margin-top: 0pt; margin-right: 27pt; margin-bottom: 0pt; line-height: 1.2;"><span style="color: rgb(47, 84, 150); font-family: Calibri, sans-serif; font-size: 13pt;"> </span><span style="color: rgb(47, 84, 150); font-family: Calibri, sans-serif; font-size: 13pt; background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;">Policy validity schedule</span><br></p><p dir="ltr" style="margin-top: 0pt; margin-right: 27pt; margin-bottom: 0pt; line-height: 1.2;"><span style="background-color: transparent; font-size: 16pt; white-space: pre-wrap; color: rgb(47, 84, 150); font-family: Calibri, sans-serif;">Attribute-based access control</span></p><p dir="ltr" style="margin-top: 0pt; margin-right: 27pt; margin-bottom: 0pt; line-height: 1.2;"><span style="background-color: transparent; font-size: 16pt; white-space: pre-wrap; color: rgb(47, 84, 150); font-family: Calibri, sans-serif;">Resource-based access control</span></p><p dir="ltr" style="margin-top: 0pt; margin-right: 27pt; margin-bottom: 0pt; line-height: 1.2;"><span style="background-color: transparent; font-size: 16pt; white-space: pre-wrap; color: rgb(47, 84, 150); font-family: Calibri, sans-serif;">Tag-based access control</span></p><p dir="ltr" style="margin-top: 0pt; margin-right: 27pt; margin-bottom: 0pt; line-height: 1.2;"><span style="background-color: transparent; font-size: 16pt; white-space: pre-wrap; color: rgb(47, 84, 150); font-family: Calibri, sans-serif;">Data masking</span></p><p dir="ltr" style="margin-top: 0pt; margin-right: 27pt; margin-bottom: 0pt; line-height: 1.2;"><span style="background-color: transparent; font-size: 16pt; white-space: pre-wrap; color: rgb(47, 84, 150); font-family: Calibri, sans-serif;">Row-filter</span></p><p dir="ltr" style="margin-top: 0pt; margin-right: 27pt; margin-bottom: 0pt; line-height: 1.2;"><span style="background-color: transparent; font-size: 16pt; white-space: pre-wrap; color: rgb(47, 84, 150); font-family: Calibri, sans-serif;">Access audit logs</span></p><p dir="ltr" style="margin-top: 0pt; margin-right: 27pt; margin-bottom: 0pt; line-height: 1.2;"><span style="background-color: transparent; font-size: 16pt; white-space: pre-wrap; color: rgb(47, 84, 150); font-family: Calibri, sans-serif;">References</span></p><h1 dir="ltr" style="margin-bottom: 0pt; line-height: 1.2;"><br></h1><p dir="ltr" style="text-align: left; line-height: 1.2; margin-right: 27pt; margin-top: 0pt; margin-bottom: 0pt;"><span style="background-color: transparent; color: rgb(47, 84, 150); font-family: Calibri, sans-serif; font-size: 16pt; white-space: pre-wrap;">Introduction</span><br></p><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Apache Ranger is an extensible framework that enables enterprises to adopt a consistent approach to authorize access to their resources across multiple services/applications/cloud. Apache Ranger framework also enables enterprises to collect audit logs of access to their resources, to help meet various compliance requirements.</span></p><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><br></span></p><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Apache Ranger is a central part of security in many large deployments in enterprises across various domains like finance, retail, insurance, healthcare, services. Apache Ranger has out-of-the box support for a large number of popular services and many more services are supported by commercial vendors. Apache Ranger is highly optimized for performance, adds negligible overhead in authorizing access to resources. It has been very well proven in very high throughput services like Apache Kafka, Apache HBase which perform thousands of authorizations per second.</span></p><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><br></span></p><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Apache Ranger provides an intuitive web user interface to manage authorization policies and audit logs for access to resources across a large number of services. Apache Ranger also provides REST, Python, Java APIs for programmatic integration with tools used by enterprises. Open framework provided by Apache Ranger enables enterprises to extend Apache Ranger authorization to their own applications and services as well.</span></p><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><br></span></p><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Here are few key points that make Apache Ranger a compelling option for enterprises looking to standardize authorization of access to their resources:</span></p><ul style="margin-top:0;margin-bottom:0;padding-inline-start:48px;"><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;" role="presentation"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">out-of-the-box support for more than a dozen popular services like Apache Hive, Apache HBase, Apache Kafka, Apache Solr, Elasticsearch, Apache NiFi and Presto</span></p></li><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;" role="presentation"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">support for services like Amazon EMR, AWS S3, ADLS-Gen2, GCS, Snowflake, Google BigQuery, Trino, Dremio, Starburst, Apache Impala, Postgres, MS-SQL and Amazon Redshift by commercial vendors</span></p></li><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;" role="presentation"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">policies for access authorization, row-filters, data masking</span></p></li><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;" role="presentation"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">resource-based, classification-based policies, role-based, attribute-based policies</span></p></li><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;" role="presentation"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">delegated administration, deny and exceptions in policies, custom conditions</span></p></li><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;" role="presentation"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">centralized audit logs of accesses to enterprise resources across multiple services, interactive user interface to view audit logs of accesses</span></p></li><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;" role="presentation"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">intuitive policy management UI</span></p></li><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;" role="presentation"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Java, Python, REST APIs for programmatic integration for policy management</span></p></li><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;" role="presentation"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">open framework which enables enterprises to extend Apache Ranger authorization to their own applications and services</span></p></li></ul><p class="MsoNormal" align="center" style="text-align: left;"><b style="font-weight:normal;"><br></b></p><h1 dir="ltr" style="line-height:1.2;margin-top:12pt;margin-bottom:0pt;"><span style="font-size:16pt;font-family:Calibri,sans-serif;color:#2f5496;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Policy Model</span></h1><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">At the core of Apache Ranger authorization is its policy model. We will go through key aspects of the Apache Ranger policy model in this section.</span></p><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><br></span></p><h2 dir="ltr" style="line-height:1.2;margin-top:2pt;margin-bottom:0pt;"><span style="font-size:13pt;font-family:Calibri,sans-serif;color:#2f5496;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Resources</span></h2><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">A resource is a fundamental element in the Apache Ranger policy model. Apache Ranger enables policies to authorize access to resources. In this context, a resource is anything whose access needs to be authorized, like a file/path, database, table, column, topic; but can also be a service – like Apache Knox topology. Apache Ranger policy model captures details of resources of a service in a declarative way – details like hierarchy, case-sensitivity, supports row-filter/data-masking, etc.</span></p><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><br></span><span style="background-color: transparent; font-size: 12pt; white-space: pre-wrap; font-family: Calibri, sans-serif;">Type of resources vary across services/applications, as seen in the table below:</span></p><div dir="ltr" style="margin-left:24.950000000000003pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col width="133"><col width="364"></colgroup><tbody><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: center;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Service</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: center;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Resources</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Apache Hive</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">databases, tables, columns, udfs</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Apache Kafka</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">topics</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Apache Solr</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">collections</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">AWS S3</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">buckets, objects</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">ADLS-Gen2</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">storage-accounts, containers, objects</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Azure PowerBI</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">workspaces</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Google BigQuery</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">projects, datasets, tables, columns</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Snowflake</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">databases, schemas, tables, columns, warehouses</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Trino</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">catalogs, schemas, tables, columns, procedures</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">...</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><br></td></tr></tbody></table></div><p class="MsoNormal" align="center" style="text-align: left;"><b style="font-weight:normal;"><br></b></p><h2 dir="ltr" style="line-height:1.2;margin-top:2pt;margin-bottom:0pt;"><span style="font-size:13pt;font-family:Calibri,sans-serif;color:#2f5496;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Permissions</span></h2><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">A permission is another fundamental element in the Apache Ranger policy model. A permission is an action performed on a resource, like </span><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">reading</span><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"> a file, </span><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">creating</span><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"> a directory, </span><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">querying</span><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"> a table, </span><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">or publishing a</span><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"> message to a topic. Apache Ranger policy model captures details of permissions of a service in a declarative way – details like which permissions are applicable to specific resource types, implied permissions, etc.</span></p><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><br></span><span style="background-color: transparent; font-size: 12pt; white-space: pre-wrap; font-family: Calibri, sans-serif;">Like resources, list of permissions varies across services/applications, as seen in the table below:</span></p><div dir="ltr" style="margin-left:24.950000000000003pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col width="133"><col width="432"></colgroup><tbody><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: center;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Service</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: center;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Permissions</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Apache Hive</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">create, alter, drop, select, insert, ..</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Apache Kafka</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">publish, consume, create, delete, describe, configure, ..</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Apache Solr</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">query, update, others, Solr admin</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">AWS S3</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">read, write, delete, ..</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">ADLS-Gen2</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">read, write, delete, ..</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Azure PowerBI</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">contributor, member, admin, none</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Google BigQuery</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">project-list, dataset-create, table-create, table-list, query, ..</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Snowflake</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">CreateSchema, CreateTable, Select, Insert, Update, ..</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Trino</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">create, alter, drop, select, insert, ..</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">...</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><br></td></tr></tbody></table></div><p class="MsoNormal" align="center" style="text-align: left;"><b style="font-weight:normal;"><br></b></p><h2 dir="ltr" style="line-height:1.2;margin-top:2pt;margin-bottom:0pt;"><span style="font-size:13pt;font-family:Calibri,sans-serif;color:#2f5496;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Users, Groups, Roles</span></h2><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Apache Ranger enables authorization policies to be set up to allow/deny permissions to users, groups, and roles. Users and groups are typically obtained from an enterprise directory like AD/LDAP. Apache Ranger user-sync module handles details of bringing users and groups from sources like LDAP/AD/OS, and keeping up with the changes in the sources - like addition of users and groups, addition/removal of a user from a group.</span></p><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><br></span><span style="background-color: transparent; font-family: Calibri, sans-serif; font-size: 12pt; white-space: pre-wrap;">Apache Ranger user-sync supports retrieving attributes of users and groups as well. Such attributes, like dept/location/site-id, can be used in authorization policies to allow/deny access to resources, and set up row-filters that restrict users to access relevant subset of data. More on this later in this document.</span></p><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><br></span><span style="background-color: transparent; font-size: 12pt; white-space: pre-wrap; font-family: Calibri, sans-serif;">In addition to users and groups, Apache Ranger supports roles to be used in authorization policies. A role in Apache Ranger is a grouping of users, groups, and other roles. Roles can be managed using Apache Ranger UI and REST APIs by authorized users. Role based authorization is widely used in enterprises and having support for roles in Apache Ranger makes it possible to use well established enterprise security practices in Apache Ranger authorization policies.</span></p><p class="MsoNormal" align="center" style="text-align: left;"><b style="font-weight:normal;"><br></b></p><h2 dir="ltr" style="line-height:1.2;margin-top:2pt;margin-bottom:0pt;"><span style="font-size:13pt;font-family:Calibri,sans-serif;color:#2f5496;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Delegated Admin</span></h2><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Apache Ranger enables decentralization of authorization policies management with support for delegated-admin feature. A set of users, groups and roles can be granted permission, via an Apache Ranger policy (what else!), to manage authorization policies for a subset of resources and permissions. For example, users in </span><span style="font-size:12pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">finance-admin</span><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"> group can be granted permissions to manage authorization policies for contents of Snowflake database named </span><span style="font-size:12pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">finance</span><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">, and AWS S3 objects under </span><span style="font-size:12pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">s3://mybucket/dept/finance</span><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">. This offers a scalable approach to manage authorization in large deployments.</span></p><p class="MsoNormal" align="center" style="text-align: left;"><b style="font-weight:normal;"><br></b></p><h2 dir="ltr" style="line-height:1.2;margin-top:2pt;margin-bottom:0pt;"><span style="font-size:13pt;font-family:Calibri,sans-serif;color:#2f5496;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Security Zone</span></h2><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Apache Ranger supports security zones to enable multi-tenancy within an organization where admins from different lines of businesses can manage security policies for their own resources. For example, data that belongs to the sales team can be managed by administrators of the sales team, similarly data of marketing, sales, operations teams can be managed by respective administrators.</span></p><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><br></span><span style="background-color: transparent; font-size: 12pt; white-space: pre-wrap; font-family: Calibri, sans-serif;">Also, security zones can be used to isolate resources based on purpose. For example, it is common for a data lake to have distinct areas and authorization policies for test data, unprocessed/raw data, semi-processed data, and production data. Apache Ranger makes it easier to manage security policies in such deployments with use of security zones like:</span></p><ul style="margin-top:0;margin-bottom:0;padding-inline-start:48px;"><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;" role="presentation"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Test zone</span></p></li><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;" role="presentation"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Landing zone</span></p></li><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;" role="presentation"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Staging zone</span></p></li><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;" role="presentation"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Production zone</span></p></li></ul><p class="MsoNormal" align="center" style="text-align: left;"><span style="background-color: transparent; font-size: 12pt; white-space: pre-wrap; text-align: justify;"><br></span></p><p class="MsoNormal" align="center" style="text-align: left;"><span style="background-color: transparent; font-size: 12pt; white-space: pre-wrap; text-align: justify;">A security zone can contain resources from multiple services/applications, like AWS S3, ADLS-Gen2, GCS, Snowflake, Amazon Redshift, Postgres, Apache Hadoop, Apache Hive, Apache HBase, Apache Kafka. This makes it easier to set up consistent authorization policies across multiple services by a set of administrators designated for each security zone. </span><br></p><p class="MsoNormal" align="center" style="text-align: left;"><b style="font-weight:normal;"><br></b></p><h2 dir="ltr" style="line-height:1.2;margin-top:2pt;margin-bottom:0pt;"><span style="font-size:13pt;font-family:Calibri,sans-serif;color:#2f5496;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Allow, Deny, Exceptions</span></h2><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">In addition to authorization policies that can grant access to resources, Apache Ranger also enables policies to be setup to:</span></p><ul style="margin-top:0;margin-bottom:0;padding-inline-start:48px;"><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;" role="presentation"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">deny access to users/groups/roles on resources </span></p></li><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;" role="presentation"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">exclude a subset of users from accesses allowed/denied above</span></p></li><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;" role="presentation"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">deny all access to specific resources other than the ones allowed in the policy</span></p></li></ul><p class="MsoNormal" align="center" style="text-align: left;"><span style="background-color: transparent; font-size: 12pt; white-space: pre-wrap; text-align: justify;"><br></span></p><p class="MsoNormal" align="center" style="text-align: left;"><span style="background-color: transparent; font-size: 12pt; white-space: pre-wrap; text-align: justify;">This makes it easier to set up policies to protect sensitive resources.</span><br></p><p class="MsoNormal" align="center" style="text-align: left;"><b style="font-weight:normal;"><br></b></p><h2 dir="ltr" style="line-height:1.2;margin-top:2pt;margin-bottom:0pt;"><span style="font-size:13pt;font-family:Calibri,sans-serif;color:#2f5496;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Wildcards, macros, variables in resource names</span></h2><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Apache Ranger policies support use of wildcards, macros, and variables in resource names. This makes it possible to use small number of policies for a large number of resources, as shown below:</span></p><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><br></span></p><div dir="ltr" style="margin-left:-1.1500000000000004pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col width="210"><col width="414"></colgroup><tbody><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">test_*</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">matches all resources having name that start with </span><span style="font-size:12pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">test_</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">/home/{USER}</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">a path under /home having name of current user</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">/dept/${{USER.dept}}</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">a path under /dept having name of current user’s department</span></p></td></tr></tbody></table></div><p class="MsoNormal" align="center" style="text-align: left;"><b style="font-weight:normal;"><br></b></p><h2 dir="ltr" style="line-height:1.2;margin-top:2pt;margin-bottom:0pt;"><span style="font-size:13pt;font-family:Calibri,sans-serif;color:#2f5496;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Policy validity schedule</span></h2><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Apache Ranger enables policies to be effective only for specific time schedules. This feature can be used to create policies that need to be effective at a future time, for example to allow access to revenue reports for a wider audience only after a specific time. This feature can also be used to allow temporary access to specific users/groups/roles, with a specific start and end times.</span></p><h1 dir="ltr" style="line-height:1.2;margin-top:12pt;margin-bottom:0pt;"><span style="font-size:16pt;font-family:Calibri,sans-serif;color:#2f5496;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Attribute-based access control</span></h1><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Apache Ranger enables use of user, group, resource, classification, and the environment attributes in authorization policies.</span></p><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="background-color: transparent; font-family: Calibri, sans-serif; font-size: 12pt; white-space: pre-wrap;"><br></span></p><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="background-color: transparent; font-family: Calibri, sans-serif; font-size: 12pt; white-space: pre-wrap;">ABAC makes it possible to express authorization policies without prior knowledge of specific resources, specific users – which helps avoid the need for new policies as new resources or users are introduced. For example:</span><br></p><ul style="margin-top:0;margin-bottom:0;padding-inline-start:48px;"><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;" role="presentation"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">allow each user to access all tables owned by them, using</span><span style="font-size:12pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:700;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">{OWNER}</span><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"> macro in the following policy:</span></p></li></ul><div dir="ltr" style="margin-left:36pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col width="117"><col width="226"></colgroup><tbody><tr style="height:17.25pt"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">resource</span></p></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">database=*, table=*</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">users</span></p></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:700;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">{OWNER}</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">permissions</span></p></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">all</span></p></td></tr></tbody></table></div><p class="MsoNormal" align="center" style="text-align: left;"><b style="font-weight:normal;"><br></b></p><ul style="margin-top:0;margin-bottom:0;padding-inline-start:48px;"><li dir="ltr" style="list-style-type: disc; background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;" aria-level="1"><p dir="ltr" style="line-height: 1.2; text-align: justify; margin-top: 0pt; margin-bottom: 0pt;" role="presentation"><span style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 12pt; font-style: normal; font-variant: normal; font-weight: 400; white-space: pre-wrap; text-decoration: none; background-color: transparent; vertical-align: baseline;">allow users to access their department data in AWS S3, by using user attribute </span><span style="color: rgb(0, 0, 0); font-family: "Courier New"; font-size: 12pt; font-style: italic; font-variant: normal; font-weight: 700; white-space: pre-wrap; text-decoration: none; background-color: transparent; vertical-align: baseline;">${{USER.dept}}</span><span style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 12pt; font-style: normal; font-variant: normal; font-weight: 400; white-space: pre-wrap; text-decoration: none; background-color: transparent; vertical-align: baseline;"> in the following policy:</span></p><p></p></li></ul><div dir="ltr" style="margin-left:36pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col width="129"><col width="447"></colgroup><tbody><tr style="height:0pt"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">resource</span></p></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">bucket=mycompany, object=/data/</span><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:700;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">${{USER.dept}}</span><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">/*</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">users</span></p></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">{USER}</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">permissions</span></p></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">read, write</span></p></td></tr></tbody></table></div><p class="MsoNormal" align="center" style="text-align: left;"><b style="font-weight:normal;"><br></b></p><ul style="margin-top:0;margin-bottom:0;padding-inline-start:48px;"><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;" role="presentation"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">allow users in mktg group to access PII data of email type, by using tag attribute </span><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:700;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">TAG.piiType</span><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"> in the following policy:</span></p></li></ul><div dir="ltr" style="margin-left:36pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col width="128"><col width="448"></colgroup><tbody><tr style="height:0pt"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">resource</span></p></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">tag=PII</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">groups</span></p></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">mktg</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">condition</span></p></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:700;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">TAG.piiType == 'email'</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">permissions</span></p></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">select</span></p></td></tr></tbody></table></div><p class="MsoNormal" align="center" style="text-align: left;"><b style="font-weight:normal;"><br></b></p><ul style="margin-top:0;margin-bottom:0;padding-inline-start:48px;"><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;" role="presentation"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">tables with SENSITIVE classification should be accessible only by users having privileges for that sensitive level</span></p></li></ul><div dir="ltr" style="margin-left:36pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col width="128"><col width="448"></colgroup><tbody><tr style="height:0pt"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">resource</span></p></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">tag=SENSITIVE</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">groups</span></p></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">public</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">condition</span></p></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:700;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">TAG.sensitiveLevel <= USER.allowedSensitiveLevel</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">permissions</span></p></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">select</span><span style="background-color: transparent; font-family: Calibri, sans-serif; font-size: 12pt; white-space: pre-wrap; text-align: justify;"> </span></p></td></tr></tbody></table></div><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><br></span></p><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">ABAC can be used to set up row-filters as well. For example:</span></p><ul style="margin-top:0;margin-bottom:0;padding-inline-start:48px;"><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;" role="presentation"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">restrict managers to access only records of employees in their department, by using user attribute </span><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:700;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">${{USER.deptCode}}</span><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"> in the following row-filter policy:</span></p></li></ul><div dir="ltr" style="margin-left:36pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col width="128"><col width="448"></colgroup><tbody><tr style="height:0pt"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">resource</span></p></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">database=hr, table=employee</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">groups</span></p></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">managers</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">row-filter</span></p></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">dept_code = </span><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:700;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">${{USER.deptCode}}</span></p></td></tr></tbody></table></div><p class="MsoNormal" align="center" style="text-align: left;"><b style="font-weight:normal;"><br></b></p><ul style="margin-top:0;margin-bottom:0;padding-inline-start:48px;"><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;" role="presentation"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">restrict store administrators to access only data of the stores they manage, by using user attribute </span><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:700;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">${{USER.empId}}</span><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"> and look up table store_admins in following row-filter policy:</span></p></li></ul><div dir="ltr" style="margin-left:36pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col width="113"><col width="463"></colgroup><tbody><tr style="height:0pt"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">resource</span></p></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">database=sales, table=store_sales</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">groups</span></p></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">store-admin</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">row-filter</span></p></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">store_id in (select sa.store_id</span></p><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"> from store_admins sa</span></p><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"> where sa.admin_id = </span><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:700;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">${{USER.empId}}</span><span style="font-size:11pt;font-family:'Courier New';color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">)</span></p></td></tr></tbody></table></div><p class="MsoNormal" align="center" style="text-align: left;"><b style="font-weight:normal;"><br></b></p><h1 dir="ltr" style="line-height:1.2;margin-top:12pt;margin-bottom:0pt;"><span style="font-size:16pt;font-family:Calibri,sans-serif;color:#2f5496;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Resource-based access control</span></h1><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Apache Ranger enables setting up policies to grant or deny permissions to users/group/roles based on specific resource names, like:</span></p><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span class="Apple-tab-span" style="white-space:pre;"> </span></span></p><div dir="ltr" style="margin-left:12.6pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col width="113"><col width="240"><col width="247"></colgroup><tbody><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: center;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Service</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: center;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Resource</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;text-align: center;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Permissions</span></p></td></tr><tr style="height:63.75pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Apache Hive</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><br><div dir="ltr" style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col width="74"><col width="147"></colgroup><tbody><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">database</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">sales</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">table</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">order_data</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">column</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">order_amount</span></p></td></tr></tbody></table></div><br></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">select</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Apache Kafka</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><br><div dir="ltr" style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col width="53"><col width="168"></colgroup><tbody><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">topic</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">finance</span></p></td></tr></tbody></table></div><br></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">publish, consume</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">AWS S3</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><br><div dir="ltr" style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col width="76"><col width="145"></colgroup><tbody><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">bucket</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">mycompany</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">path</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">/home/{USER}/</span></p></td></tr></tbody></table></div><br></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">read, write, delete</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">ADLS-Gen2</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><br><div dir="ltr" style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col width="125"><col width="96"></colgroup><tbody><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">storage-account</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">mycompany</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">container</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">home</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">path</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">/{USER}</span></p></td></tr></tbody></table></div><br></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">read, write, delete</span></p></td></tr><tr style="height:0pt"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">...</span></p></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><br></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:0pt 5.4pt 0pt 5.4pt;overflow:hidden;overflow-wrap:break-word;"><br></td></tr></tbody></table></div><p class="MsoNormal" align="center" style="text-align: left;"><b style="font-weight:normal;"><br></b></p><h1 dir="ltr" style="line-height:1.2;margin-top:12pt;margin-bottom:0pt;"><span style="font-size:16pt;font-family:Calibri,sans-serif;color:#2f5496;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Tag-based access control</span></h1><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">In addition to authorization policies on resources, Apache Ranger enables policies to be set up on classifications (tags) associated with resources. This feature enables enterprises to separate responsibility of classification of resources (PII, PCI, PHI, credit card number, etc.) from setting up access-control policies. Classifications created, by a team of data stewards and tools that scan data for sensitive information, can be leveraged to drive authorization to access the resources.</span></p><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><br></span><span style="background-color: transparent; font-family: Calibri, sans-serif; font-size: 12pt; white-space: pre-wrap;">Authorization policies on the classifications themselves, instead of directly on the resources, will ensure that appropriate policies will automatically be applied as classifications are added , removed, and updated on resources. Also, a single tag-based policy (for example on PII) can be used to authorize access to resources across multiple services like AWS S3, ADLS-Gen2, Snowflake, Databricks SQL, Apache Hive, Apache HBase, Apache Kafka. This can significantly reduce the complexity in managing authorization policies.</span></p><h1 dir="ltr" style="line-height:1.2;margin-top:12pt;margin-bottom:0pt;"><span style="font-size:16pt;font-family:Calibri,sans-serif;color:#2f5496;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Data masking</span></h1><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Apache Ranger data-masking policies enable enterprises to allow access to sensitive data suitably masked depending on the context in which a user accesses the data. Some users will need the data without masking, while some other users can only be allowed to see partial or masked or transformed value. While authorization policies can be used to either allow or deny access to certain data, data-masking policies enable dynamically mask sensitive data as users access the data, for example to ensure that:</span></p><ul style="margin-top:0;margin-bottom:0;padding-inline-start:48px;"><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;" role="presentation"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">analysts have access to only specific part of birthday (year or month or day)</span></p></li><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;" role="presentation"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">only last 4 digits of a national id are available to customer service representatives</span></p></li><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;" role="presentation"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">only salary ranges of employees (i.e., not the salary) are available to analysts</span></p></li></ul><p class="MsoNormal" align="center" style="text-align: left;"><span style="background-color: transparent; font-size: 12pt; text-align: justify; white-space: pre-wrap;"><br></span></p><p class="MsoNormal" align="center" style="text-align: left;"><span style="background-color: transparent; font-size: 12pt; text-align: justify; white-space: pre-wrap;">In addition to supporting data-masking policies on resources, like columns in Apache Hive/Snowflake/Databricks SQL/Presto, Apache Ranger enables setting up data-masking policies based on classifications (tags) associated with resources. This can significantly reduce the complexity in managing masking policies. In addition, tag-based masking policies leverage classifications added to resources by data stewards and tools that scan data for sensitive information.</span><br></p><h1 dir="ltr" style="line-height:1.2;margin-top:12pt;margin-bottom:0pt;"><span style="font-size:16pt;font-family:Calibri,sans-serif;color:#2f5496;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Row-filter</span></h1><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Apache Ranger row-filter policies enable enterprises to allow users to access only a subset of data depending upon the context in which a user accesses the data. When a table having a row-filter is accessed by the user, only a subset of rows will be visible to the user – depending upon the filter setup in row-filter policy. Row-filters can be used for example to ensure that:</span></p><ul style="margin-top:0;margin-bottom:0;padding-inline-start:48px;"><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;" role="presentation"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">data of customers residing in a country is available only to analysts authorized to access the country’s data</span></p></li><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;" role="presentation"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">a store manager has access to only data relevant to the store she/he works in</span></p></li><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;" role="presentation"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">analysts don’t have access to sensitive records</span></p></li></ul><h1 dir="ltr" style="line-height:1.2;margin-top:12pt;margin-bottom:0pt;"><span style="font-size:16pt;font-family:Calibri,sans-serif;color:#2f5496;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Access audit logs</span></h1><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Apache Ranger generates audit logs of accesses to resources protected by Apache Ranger authorization. Apache Ranger can be configured to store audit logs in multiple destinations, including Solr, HDFS, AWS S3, AWS CloudWatch, ADLS-Gen2, Elasticsearch. Audit logs generated by Apache Ranger include following details, which can help enterprises to satisfy various compliance requirements:</span></p><ul style="margin-top:0;margin-bottom:0;padding-inline-start:48px;"><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;" role="presentation"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">resource accessed; action performed; was access allowed</span></p></li><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;" role="presentation"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">time of access, tags associated with the resource (PII, PCI, PHI, ..)</span></p></li><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;" role="presentation"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">who performed the access, IP address from which the access was performed</span></p></li><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;text-align: justify;margin-top:0pt;margin-bottom:0pt;" role="presentation"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">ID of Apache Ranger policy that allowed or denied the access</span></p></li></ul><p class="MsoNormal" align="center" style="text-align: left;"><span style="background-color: transparent; font-size: 12pt; text-align: justify; white-space: pre-wrap;"><br></span></p><p class="MsoNormal" align="center" style="text-align: left;"><span style="background-color: transparent; font-size: 12pt; text-align: justify; white-space: pre-wrap;">Apache Ranger provides an interactive user interface to view audit logs stored in Solr, Elasticsearch or AWS CloudWatch, with search capabilities to look for access audits for specific resources, specific users, client IP addresses, within a given time frame, specific classifications.</span><br></p><p class="MsoNormal" align="center" style="text-align: left;"><span style="background-color: transparent; font-size: 12pt; text-align: justify; white-space: pre-wrap;"><br></span><span style="background-color: transparent; font-size: 12pt; text-align: justify; white-space: pre-wrap;">Apache Ranger audit logs can be stored in ORC or JSON formats, which can then be loaded into various tools for analysis.</span></p><h1 dir="ltr" style="line-height:1.2;margin-top:12pt;margin-bottom:0pt;"><span style="font-size:16pt;font-family:Calibri,sans-serif;color:#2f5496;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">References</span></h1><ul style="margin-top:0;margin-bottom:0;padding-inline-start:48px;"><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;" role="presentation"><a href="https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=61322361" style="text-decoration:none;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#1155cc;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:underline;-webkit-text-decoration-skip:none;text-decoration-skip-ink:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Apache Ranger: tag-based policies</span></a></p></li><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;" role="presentation"><a href="https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=65868896" style="text-decoration:none;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#1155cc;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:underline;-webkit-text-decoration-skip:none;text-decoration-skip-ink:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Apache Ranger: row-filter and data-masking policies</span></a></p></li><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;" role="presentation"><a href="https://cwiki.apache.org/confluence/display/RANGER/Introduction+of+Security+Zones+in+Ranger" style="text-decoration:none;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#1155cc;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:underline;-webkit-text-decoration-skip:none;text-decoration-skip-ink:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Apache Ranger: security zones</span></a></p></li><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;" role="presentation"><a href="https://pypi.org/project/apache-ranger/" style="text-decoration:none;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#1155cc;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:underline;-webkit-text-decoration-skip:none;text-decoration-skip-ink:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Apache Ranger API: Python</span></a></p></li><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;" role="presentation"><a href="https://cwiki.apache.org/confluence/display/RANGER/Ranger+Client+Libraries" style="text-decoration:none;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#1155cc;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:underline;-webkit-text-decoration-skip:none;text-decoration-skip-ink:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Apache Ranger API: Java</span></a></p></li><li dir="ltr" style="list-style-type:disc;font-size:12pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;" aria-level="1"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt;" role="presentation"><a href="https://ranger.apache.org/apidocs/index.html" style="text-decoration:none;"><span style="font-size:12pt;font-family:Calibri,sans-serif;color:#1155cc;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:underline;-webkit-text-decoration-skip:none;text-decoration-skip-ink:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Apache Ranger API: REST</span></a></p></li></ul><p class="MsoNormal" align="center" style="text-align: center;"><br></p>
|
|
|
| <p class="MsoNormal" style="text-align:justify"><span style="font-size:10.5pt"></span></p>
|
|
|
| </div>
|
|
|
|
|
|
|
|
|
