Apache Ranger

Apache Ranger is a framework for centralized, fine-grained authorization and auditing across data and AI platforms. Policies are managed in one place, Ranger Admin, through its web UI or REST API, and are enforced by Ranger plugins inside the protected services, which also record an audit trail of access decisions. Policies can be based on resources, tags or attributes, and can filter rows and mask columns.

Documentation, release notes and downloads: https://ranger.apache.org/

Quick start

Released versions of Ranger Admin are published on Docker Hub as apache/ranger. It runs with a database, apache/ranger-db (PostgreSQL), and an audit store, apache/ranger-solr; the apache/ranger page has the commands to start all three. Then open http://localhost:6080 and log in as admin / rangerR0cks!.

These images are for evaluation and development; they use well-known default passwords.

Plugins

Ranger Admin stores policies; each service enforces them through a Ranger plugin that runs inside it. To protect a service, set up its plugin. The plugin downloads the service's policies from Ranger Admin, authorizes each request locally and sends audit events to the audit store.

Plugins that ship with Apache Ranger are released as ranger-<version>-<service>-plugin.tar.gz archives, also written to target/ by a source build; the KMS plugin is part of this repo. The other services ship the plugin themselves and enable it in their own configuration. Applications not listed above can authorize requests with the Ranger authorization API (authz-api), either evaluating policies in process (authz-embedded) or sending each request to the PDP server (authz-remote, available from the 2.9 release onwards).

Build from source

Requirements

• Linux or macOS
• JDK 17
• Apache Maven 3.6.3 or newer
• Git
• Python 3, for the Python client tests (not needed with -DskipTests)
• Docker with Compose v2, only to build or run Ranger in containers

Build

git clone https://github.com/apache/ranger.git
cd ranger
mvn clean install                # full build: unit tests and code checks
mvn clean package -DskipTests    # faster: skips unit tests and code checks

The build writes a ranger-<version>-<component>.tar.gz archive for each service, plugin and tool to target/, for example ranger-<version>-admin.tar.gz.

To build without a local JDK or Maven, use the build container in dev-support/ranger-docker; it writes the archives to dev-support/ranger-docker/dist/.

To work in an IDE, open the root pom.xml as a Maven project. An IntelliJ IDEA code style scheme is in dev-support/RangerCodeScheme-IntelliJ.xml.

Run your build in Docker

dev-support/ranger-docker builds images from these archives and runs Ranger Admin with its database and audit store, the other Ranger services, and services with Ranger plugins enabled, such as Trino, Ozone, Kafka, Hive and HBase. CI uses the same setup. Its README has the steps; like the Docker Hub images, it is meant for development only.

Contributing

Contributions are accepted as GitHub pull requests.

1. Find or file an issue in the RANGER JIRA project. Discuss larger changes on dev@ranger.apache.org first.
2. Open a pull request against master titled RANGER-XXXX: <subject> and fill in the template.
3. Keep CI green. It runs mvn clean verify on JDK 17 (unit tests, checkstyle, PMD, SpotBugs, RAT) and checks that the Docker containers start.

A committer merges the pull request once it is approved. See the contributing guide and the code style guide.

Reporting security issues

Report suspected vulnerabilities privately to security@apache.org, not in JIRA, GitHub or the mailing lists. See SECURITY.md.

Community

• Questions about using Ranger: user@ranger.apache.org (subscribe)
• Development: dev@ranger.apache.org (subscribe)
• Chat: Ranger channel on the ASF Slack
• Issues: RANGER JIRA project

License

Apache Ranger is licensed under the Apache License, Version 2.0.