title: “Apache Ranger 2.4.0”

Apache Ranger 2.4.0 release notes

Apache Ranger 2.4.0 was released on March 30, 2023. The release adds fine-grained access control over nested data structures, a performance analyzer tool, official docker images on Docker Hub and multiple policy-model enhancements.

Highlights

  • Nested structure plugin — fine-grained access control over nested structures such as JSON documents (RANGER-3828).
  • Performance and scalability analyzer tool for Ranger (RANGER-3852).
  • External user store retriever (RangerExternalUserStoreRetriever) for attribute-based policies (RANGER-3855); user attributes in masking expressions (RANGER-3865), default values when an attribute is missing (RANGER-3997).
  • Policy model — multiple resource sets in a policy (RANGER-3796), access-type categories such as Create/Read/Update/Delete/Manage (RANGER-4035), option to disable default policies per hierarchy (RANGER-4011), service-definition option to include the expression condition implicitly (RANGER-4117).
  • Administration — anonymous download of policies, roles and tags (RANGER-3623), non-admin users can manage roles (RANGER-3837), Ranger Admin client for non-Kerberized servers (RANGER-3856), requestId in logs via RangerMDCFilter (RANGER-4024).
  • Clients — Python client for Ranger KMS (RANGER-3982) and security-zone APIs in the Python and Java clients (RANGER-4080, RANGER-4101).
  • Trino — column masks and row filters with Trino SPI 376+ (RANGER-3983), views distinguished from tables (RANGER-3988).
  • Docker — official images published to Docker Hub (RANGER-4044), Ranger KMS in docker (RANGER-3978).
  • Dependencies — HBase 2.4.6 (RANGER-3971), Elasticsearch 7.10.2 (RANGER-3165), Solr 8.11.2 (RANGER-3818), Tomcat 8.5.86 (RANGER-4113), EclipseLink (RANGER-4107); builds on Apple Silicon (RANGER-3863).

Artifacts

ArtifactLocation
Source tarballapache-ranger-2.4.0.tar.gz (signature, SHA-512)
Release directoryhttps://archive.apache.org/dist/ranger/2.4.0/
Git tagrelease-ranger-2.4.0
Docker imagesapache/ranger:2.4.0, apache/ranger-db:2.4.0, apache/ranger-solr:2.4.0, apache/ranger-zk:2.4.0 on Docker Hub
Maven Centralorg.apache.ranger:*:2.4.0
Archivearchive.apache.org/dist/ranger/2.4.0/

Verify every download against its .asc signature and checksum file before you use it; see Download and verify.

Resolved issues

The tables below list the 142 JIRA issues recorded in the release notes for this version (5 new features, 46 improvements, 80 bugs fixed, 7 tasks, 4 tests). Each key links to the issue in the Apache JIRA.

New features

JIRASummary
RANGER-3828Fine-grained Access Control over nested structures
RANGER-3852Performance and scalability analyzer tool for Ranger
RANGER-3855RangerExternalUserStoreRetriever class
RANGER-3971Upgrade HBASE version to 2.4.6
RANGER-4028Ranger - Upgrade bootbox.js.

Improvements

JIRASummary
RANGER-2928[Ranger Zone REST API] Resources data is missing in XML format
RANGER-3165Upgrade Elasticsearch version in Ranger to Elasticsearch 7.10.2
RANGER-3534Review of RangerHiveAuditHandler
RANGER-3623Add ability to enable anonymous download of policy/role/tag
RANGER-3633Remove eclipse .project file from git
RANGER-3664Ranger KMS : Add refresh functionality on kms key listing page.
RANGER-3763The max limit of the requested entities is not configurable in tagsync
RANGER-3767Add text message in HDFS and YARN policy pages to highlight the fallback ACL option
RANGER-3787Non-daemon threads started by ElasticSearchAuditDestination cause Spark application hanging
RANGER-3794Improve performance of delete users/groups utility
RANGER-3796Enhancement to support multiple resource sets in a policy
RANGER-3818Upgrade Solr to 8.11.2
RANGER-3822RangerService outputs password information in plaintext
RANGER-3837Allow Ranger non-admins to get, create, edit and delete roles
RANGER-3856Ranger admin client option to work with non-kerberized server
RANGER-3865support for using user attributes in masking expressions
RANGER-3900Roles deletion Takes time in Apache Ranger when there are more users,groups,roles
RANGER-3902dbLoadTime is not added correctly in RangerServicePoliciesCache
RANGER-3903Improvement in RangerPolicyDeltaUtil--> applyDeltas method
RANGER-3910API Documentation is broken for knox sso
RANGER-3934improve tag cache handling to reduce resource usage
RANGER-3940Add javascript includes(), intersects() polyfills for array prototype to RangerCommonConstants
RANGER-3948update serialization to skip empty values
RANGER-3951optimize memory used for tags in plugins and server
RANGER-3955optimization to reduce duplicate strings
RANGER-3973LDAP incremental search not always available
RANGER-3978Docker setup to run Ranger KMS
RANGER-3982Python client for Ranger KMS REST APIs
RANGER-3983Support getColumnMasks and getRowFilters in Trino SPI 376+
RANGER-3985Trino plugin: Check table name when creating tables
RANGER-3986Upgrade trino guice dependency to 5.1.0
RANGER-3988Trino plugin should differntiate between views and tables
RANGER-3997option to use default value when user/group/tag does not have the attribute
RANGER-4004During the service deletion also, we can clear the in-memory cache for that service which got deleted on the ranger side
RANGER-4011option to disable creation of default policies per hierarchy
RANGER-4012getPolicyByName searches policy by serviceName, policyName simply by traverse all policies in RangerServicePoliciesCache instead of DB
RANGER-4024Adding requestId as part of Ranger logs via RangerMDCFilter when the request header contains request-Id
RANGER-4071Support for LDAP/AD usernames and group names with special chars
RANGER-4080Python client update to add missing security-zone APIs
RANGER-4083Tag-based policy UI to not show permissions in deny/exception for services that don't support deny/exception
RANGER-4100Efficient computation of the smallest set of evaluators returned by search of multiple Trie trees
RANGER-4101Java client update to add missing security-zone APIs
RANGER-4107Upgrade EclipseLink
RANGER-4114Consistent use of plugin property prefix in context enrichers
RANGER-4117service-def option to include expression condition implictly
RANGER-4122[RangerAdmin] Reorganize authorization/access check logic

Bugs fixed

JIRASummary
RANGER-2737Ranger REST API returns different information when GET user by id and by name
RANGER-3080A service administrator should be allowed to set “excludes” flag for a policy resource
RANGER-3108NPE in RangerPolicyRepository.init
RANGER-3387Ranger Admin Header Validation.
RANGER-3394Too much varchar(4000) causes table to exceed ROW SIZE limit in MySQL
RANGER-3500Ranger policy list doesn't support sorting by field
RANGER-3670Policy update creates unnecessary entries in transaction log table
RANGER-3680mysql ErrorCode:1118 when Importing DB schema to database
RANGER-3719Can not create mysql table with charset utf8mb4.
RANGER-3775Logback.xml has been incorrectly modified by RANGER-3704.
RANGER-3789Upgrade Handlebars version to 4.7.7
RANGER-3790Ranger tagsync module should not depend on kafka server
RANGER-3791Upgrade json-smart, gson and jersey-client libraries version
RANGER-3798Ranger API Resource Metrics REST “Up time of JVM” does not update.
RANGER-3806Group's users mapping entry failing whenever primary key auto-increment is not set to 1 in db
RANGER-3807getUserRoles API gives 200 for non existing user passed to this API
RANGER-3813Fix ConcurrentModificationException in UnixUserGroupBuilder
RANGER-3814IS_IN_ROLE(roleName) condition always returns false
RANGER-3816update getResourceACLs() API to handle macros in resource names
RANGER-3819Upgrade springframework version
RANGER-3820Upgrade Netty version to 4.1.78.Final
RANGER-3824[Ranger] : /service/tags/resources error message is not proper for duplicate resource & not able to update resource resource
RANGER-3825Ranger internal user is unable to change his password after the upgrade.
RANGER-3829Incremental Sync value is always true under Ranger Audit (Usersync)
RANGER-3840SHOW DATABASES command should list databases owned by the user
RANGER-3846Ranger DB patch 058 failing when multiple policies having same resourceSignature
RANGER-3847[Ranger] : Http status & Error message is not correct for /xaudit/trx_log
RANGER-3848RangerClient does not auto renew Kerberos ticket after ticket lifetime expired
RANGER-3853Ranger java patch J10054 takes time
RANGER-3854Ranger Java patch J10056 takes time
RANGER-3857Ranger java patch J10055 takes time
RANGER-3863Ranger Failed to run on Apple M1 macOS (Apple Silicon)
RANGER-3883emailchange and passwordchange User REST API's work even when invalid user id is used in the url
RANGER-3885User REST API /users/firstnames returns only null with status code 204
RANGER-3894Application is ‘unknown’ for metastore in plugin status page
RANGER-3897RangerUserStore cache improvement
RANGER-3898Ranger Roles cache Improvement
RANGER-3907Skip auditing of operation like monitorHealth in HDFS Ranger Plugin audit handler
RANGER-3911NPE fix in RangerDefaultPolicyEvaluator
RANGER-3912Ranger Policy report for a given user should fetch policies maintained for roles belonging to that user and groups
RANGER-3914Change sync_source column's datatype from varchar to text
RANGER-3918Namespace policy that is created in Ranger by HBase Grant command not getting honored
RANGER-3920When sync'ing users from Ldap, intermittent User/Group/UserGroup membership is missing
RANGER-3941optimize cache refresh in RangerUserStoreCache
RANGER-3946ranger-yarn-plugin missing commons-lang-2.6.jar
RANGER-3953potential NPE during policy-engine initialization
RANGER-3956Upgrade Commons Text to 1.10.0
RANGER-3959condition expression validation
RANGER-3966incorrect roles used in policy evaluation for custom RangerAccessRequest impl
RANGER-3969Remove os.path.join causing incorrect windows path
RANGER-3970Expression evaluation improvements
RANGER-3977Fix Ranger TagRest API deleteTagResourceMapByGuid
RANGER-3989KMS APIs fail due to ConcurrentModificationException
RANGER-3991Upgrade underscore-min.js, underscore.js and moment-with-locales.min.js
RANGER-4000unit test failure in JDK17
RANGER-4008RangerTagEnricher to ignore invalid resources
RANGER-4014update getResourceACLs() API to handle resource names having macros in row-filter/masking policies
RANGER-4018Ranger src packaging should exclude generated/unnecessary files
RANGER-4029Ranger cannot build with HBase 2.5.x versions because preBalance coprocessor hook syntax changed in HBASE-26147
RANGER-4035support for policies to refer access-types using category, like Create/Read/Update/Delete/Manage
RANGER-4043[ugsync]Enumerate Groups will give error on executing ‘getent group’ command
RANGER-4044Publish official docker images for ranger to dockerhub
RANGER-4055Compulsory field firstName can be passed empty or null in the payload while creating user through API
RANGER-4057[Ranger] /tags/tags/cache/reset api give 200 response for invalid service
RANGER-4064RANGER-3348 introduces bug in python client for SSL enabled clusters
RANGER-4065Fix README and PyPI Doc for Ranger Python Client
RANGER-4074assignPermissionToUser in XUserMgr creates entries with NULL moduleId in x_user_module_perm
RANGER-4079Python client to use the given Ranger endpoint, instead of its baseURL
RANGER-4102update TestPolicyACLs unit test to validate ACL count
RANGER-4109Add unique constraint on resource_signature column of x_rms_service_resource table
RANGER-4110Upgrade to TLS to version 1.2 -Part2
RANGER-4112Update servicedef by name results in 400 status code while the same request works with update servicedef using id
RANGER-4113Upgrade tomcat to 8.5.86
RANGER-4121NPE in security-zone update validation
RANGER-4123No policy found for given version
RANGER-4126Fetching getDBVersion in BaseDao class in the security-admin-web throws Exception for Oracle Database
RANGER-4127Unable to delete the user if policy is created by same user and added in the policy item
RANGER-4144Fixed Kafka Test Suite Issues
RANGER-4154Usersync fails to push users to Ranger, due to missing firstName field
RANGER-4155Structure of resource(UI) hierarchy in policy form not proper formatted for multiple values.

Tasks

JIRASummary
RANGER-3780Ranger - Upgrade tomcat to 8.5.79
RANGER-3782RANGER - Upgrade spring-security version to 5.6.5
RANGER-3841update version ranger-2.4 to 2.4.0-SNAPSHOT
RANGER-3960RANGER - Upgrade spring-security version to 5.7.5
RANGER-3996Upgrade commons-configuration2 to version 2.8.0
RANGER-4116Define description/topics/merge strategy for the github repository with .asf.yaml
RANGER-4140Release Apache Ranger 2.4.0

Tests

JIRASummary
RANGER-3808Ranger的REST API接口(/roles/roles/{id}/addUsersAndGroups)本地测试提示404
RANGER-3834Test cases for RoleREST.java missing (security-admin module)
RANGER-3849Test cases for ServiceREST.java missing
RANGER-4105Python script to create/update/delete policies from multiple threads

Further reading