mkdocs/docs/release-notes/2.2.0.md

---
title: "Apache Ranger 2.2.0"
---
<!---
  Licensed to the Apache Software Foundation (ASF) under one or more
  contributor license agreements.  See the NOTICE file distributed with
  this work for additional information regarding copyright ownership.
  The ASF licenses this file to You under the Apache License, Version 2.0
  (the "License"); you may not use this file except in compliance with
  the License.  You may obtain a copy of the License at

      http://www.apache.org/licenses/LICENSE-2.0

  Unless required by applicable law or agreed to in writing, software
  distributed under the License is distributed on an "AS IS" BASIS,
  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  See the License for the specific language governing permissions and
  limitations under the License.
-->

# Apache Ranger 2.2.0 release notes

Apache Ranger 2.2.0 was released on November 1, 2021. The release introduces audit filters to reduce audit volume, Kerberos and SSL support in the client libraries, session inactivity timeout, and many UserSync, Hive and policy-engine fixes.

## Highlights

- **Audit filters** — per-service filters that decide which accesses are audited, with UI support and defaults created on
  service creation ([RANGER-3000](https://issues.apache.org/jira/browse/RANGER-3000), [RANGER-3191](https://issues.apache.org/jira/browse/RANGER-3191), [RANGER-3214](https://issues.apache.org/jira/browse/RANGER-3214), [RANGER-3228](https://issues.apache.org/jira/browse/RANGER-3228)).
- **Hive** — `SHOW ROLE GRANT` ([RANGER-2640](https://issues.apache.org/jira/browse/RANGER-2640)), URL authorization for temporary UDFs ([RANGER-3017](https://issues.apache.org/jira/browse/RANGER-3017)), fixes for role commands in Beeline sessions
  ([RANGER-3104](https://issues.apache.org/jira/browse/RANGER-3104), [RANGER-3252](https://issues.apache.org/jira/browse/RANGER-3252), [RANGER-3350](https://issues.apache.org/jira/browse/RANGER-3350)).
- **Policy engine** — ACL computation can expand roles and include chained plugins ([RANGER-3397](https://issues.apache.org/jira/browse/RANGER-3397)), read-write locks for the policy engine
  and tag repository ([RANGER-3192](https://issues.apache.org/jira/browse/RANGER-3192)), delegate-admin for specific permissions ([RANGER-3122](https://issues.apache.org/jira/browse/RANGER-3122)), more resilient incremental policy changes ([RANGER-3253](https://issues.apache.org/jira/browse/RANGER-3253)).
- **Clients** — Kerberos and SSL support in the Java client ([RANGER-2910](https://issues.apache.org/jira/browse/RANGER-2910), [RANGER-3212](https://issues.apache.org/jira/browse/RANGER-3212)) with documentation ([RANGER-3223](https://issues.apache.org/jira/browse/RANGER-3223)).
- **Admin UI and server** — session inactivity timeout ([RANGER-3363](https://issues.apache.org/jira/browse/RANGER-3363), [RANGER-3388](https://issues.apache.org/jira/browse/RANGER-3388)), audit ID shown and searchable ([RANGER-3056](https://issues.apache.org/jira/browse/RANGER-3056), [RANGER-3057](https://issues.apache.org/jira/browse/RANGER-3057)), user sync source shown
  ([RANGER-3285](https://issues.apache.org/jira/browse/RANGER-3285), [RANGER-3293](https://issues.apache.org/jira/browse/RANGER-3293)), cluster name on the service form ([RANGER-3006](https://issues.apache.org/jira/browse/RANGER-3006)), batch upload of tags ([RANGER-3309](https://issues.apache.org/jira/browse/RANGER-3309)), import policies by name/service/zone ([RANGER-3078](https://issues.apache.org/jira/browse/RANGER-3078)).
- **UserSync** — performance improvements ([RANGER-2986](https://issues.apache.org/jira/browse/RANGER-2986)), graceful handling of invalid user names ([RANGER-3207](https://issues.apache.org/jira/browse/RANGER-3207)), memory fix for 300K+ group
  mappings ([RANGER-3374](https://issues.apache.org/jira/browse/RANGER-3374)).
- **Dependencies** — Solr 8.6.3 ([RANGER-3091](https://issues.apache.org/jira/browse/RANGER-3091)), Kafka 2.5 ([RANGER-3096](https://issues.apache.org/jira/browse/RANGER-3096)), Tomcat 8.5 ([RANGER-3105](https://issues.apache.org/jira/browse/RANGER-3105)), TLS 1.2+ ([RANGER-3153](https://issues.apache.org/jira/browse/RANGER-3153)), Spring and Spring Security upgrades ([RANGER-2950](https://issues.apache.org/jira/browse/RANGER-2950)),
  Kafka client uses AdminClient instead of ZooKeeper ([RANGER-3001](https://issues.apache.org/jira/browse/RANGER-3001)).
- **Docker** — HiveServer2 with the Ranger plugin ([RANGER-3185](https://issues.apache.org/jira/browse/RANGER-3185)), cached downloads ([RANGER-3196](https://issues.apache.org/jira/browse/RANGER-3196)).

## Artifacts

| Artifact | Location |
| --- | --- |
| Source tarball | [apache-ranger-2.2.0.tar.gz](https://archive.apache.org/dist/ranger/2.2.0/apache-ranger-2.2.0.tar.gz) ([signature](https://archive.apache.org/dist/ranger/2.2.0/apache-ranger-2.2.0.tar.gz.asc), [SHA-512](https://archive.apache.org/dist/ranger/2.2.0/apache-ranger-2.2.0.tar.gz.SHA512)) |
| Release directory | [https://archive.apache.org/dist/ranger/2.2.0/](https://archive.apache.org/dist/ranger/2.2.0/) |
| Git tag | [release-ranger-2.2.0](https://github.com/apache/ranger/tree/release-ranger-2.2.0) |
| Maven Central | `org.apache.ranger:*:2.2.0` |
| Archive | [archive.apache.org/dist/ranger/2.2.0/](https://archive.apache.org/dist/ranger/2.2.0/) |

Verify every download against its `.asc` signature and checksum file before you use it; see [Download and verify](download.md).

## Resolved issues

The tables below list the 233 JIRA issues recorded in the release notes for this version (8 new features, 102 improvements, 123 bugs fixed). Each key links to the issue in the Apache JIRA.

### New features

| JIRA | Summary |
| --- | --- |
| [RANGER-2640](https://issues.apache.org/jira/browse/RANGER-2640) | Implement SHOW ROLE GRANT in Hive ranger plugin |
| [RANGER-3000](https://issues.apache.org/jira/browse/RANGER-3000) | Audit-filter feature implementation to help reduce volume of audit logs generated |
| [RANGER-3191](https://issues.apache.org/jira/browse/RANGER-3191) | Ranger UI for configuring Audit filters. |
| [RANGER-3241](https://issues.apache.org/jira/browse/RANGER-3241) | Need feature to make the access log file name configurable |
| [RANGER-3242](https://issues.apache.org/jira/browse/RANGER-3242) | Need feature to make the access log file name configurable for user |
| [RANGER-3248](https://issues.apache.org/jira/browse/RANGER-3248) | In Ranger Audit collection number of shards should be depending on the number of infra-solr nodes |
| [RANGER-3249](https://issues.apache.org/jira/browse/RANGER-3249) | Enhance RangerScriptExecutionContext class to provide APIs for comprehensive tag information |
| [RANGER-3397](https://issues.apache.org/jira/browse/RANGER-3397) | Update ACL computation to (optionally) expand Ranger Roles to users and groups and include chained-plugins in ACL computation |

### Improvements

| JIRA | Summary |
| --- | --- |
| [RANGER-2767](https://issues.apache.org/jira/browse/RANGER-2767) | Ranger showing only 100 services in ranger admin ui |
| [RANGER-2910](https://issues.apache.org/jira/browse/RANGER-2910) | Add kerberos and SSL support for client libraries |
| [RANGER-2937](https://issues.apache.org/jira/browse/RANGER-2937) | Refresh Ranger's Solr configs |
| [RANGER-2946](https://issues.apache.org/jira/browse/RANGER-2946) | Ranger UI - third party library version upgrades |
| [RANGER-2950](https://issues.apache.org/jira/browse/RANGER-2950) | Upgrade Spring framework and Spring Security libraries |
| [RANGER-2972](https://issues.apache.org/jira/browse/RANGER-2972) | REST api to delete service/ repo using cluster name |
| [RANGER-2983](https://issues.apache.org/jira/browse/RANGER-2983) | Add HBase users with decrypteek permission in default policy for kms |
| [RANGER-2986](https://issues.apache.org/jira/browse/RANGER-2986) | Performance improvements for Ranger usersync |
| [RANGER-2995](https://issues.apache.org/jira/browse/RANGER-2995) | Add 'exclude service users' option in URL param |
| [RANGER-2996](https://issues.apache.org/jira/browse/RANGER-2996) | Add search by Roles and Auditor user should be able to see "Roles" tab |
| [RANGER-2998](https://issues.apache.org/jira/browse/RANGER-2998) | API for Ranger KMS service status |
| [RANGER-3001](https://issues.apache.org/jira/browse/RANGER-3001) | Update Ranger KafkaClient to use Kafka AdminClient API instead of Zookeeper |
| [RANGER-3002](https://issues.apache.org/jira/browse/RANGER-3002) | Query info popup stuck in Ranger access audits view |
| [RANGER-3006](https://issues.apache.org/jira/browse/RANGER-3006) | Add cluster name field to service create form |
| [RANGER-3008](https://issues.apache.org/jira/browse/RANGER-3008) | Internal API for controlling Trie behavior |
| [RANGER-3011](https://issues.apache.org/jira/browse/RANGER-3011) | Code improvement for Audit Access Log Detail popup |
| [RANGER-3012](https://issues.apache.org/jira/browse/RANGER-3012) | Dockerfile to support building from local repository |
| [RANGER-3013](https://issues.apache.org/jira/browse/RANGER-3013) | Remove minor version of "jna" jar file |
| [RANGER-3017](https://issues.apache.org/jira/browse/RANGER-3017) | RangerHiveAuthorizer should authorize URL in Hive tempUDFs operation |
| [RANGER-3020](https://issues.apache.org/jira/browse/RANGER-3020) | Normalize naming and processing of config parameters for chained plugin |
| [RANGER-3024](https://issues.apache.org/jira/browse/RANGER-3024) | Improve response time and refactor code for GET API /service/xusers/lookup/users |
| [RANGER-3027](https://issues.apache.org/jira/browse/RANGER-3027) | Improve response time for GET API service/xusers/users |
| [RANGER-3029](https://issues.apache.org/jira/browse/RANGER-3029) | Ranger - Upgrade handlebars 1.3.0 to 4.6.0 |
| [RANGER-3044](https://issues.apache.org/jira/browse/RANGER-3044) | User is not able to change the password from user profile page |
| [RANGER-3050](https://issues.apache.org/jira/browse/RANGER-3050) | Password can not be changed in User Profile page |
| [RANGER-3056](https://issues.apache.org/jira/browse/RANGER-3056) | Show Audit ID in Audit->Access tab |
| [RANGER-3057](https://issues.apache.org/jira/browse/RANGER-3057) | Support Audit search based on Audit ID |
| [RANGER-3065](https://issues.apache.org/jira/browse/RANGER-3065) | RangerServiceResource model object needs to be enhanced to store/track any additional information about the resource |
| [RANGER-3067](https://issues.apache.org/jira/browse/RANGER-3067) | Schema changes to improve performance of chained plugin feature |
| [RANGER-3076](https://issues.apache.org/jira/browse/RANGER-3076) | [New UI] if service side bar expanded then include/exclude toggle button in hive policy gets shrink |
| [RANGER-3078](https://issues.apache.org/jira/browse/RANGER-3078) | Supporting import policy based on PolicyName, ServiceName and ZoneName |
| [RANGER-3087](https://issues.apache.org/jira/browse/RANGER-3087) | Making db_setup.py fool-proof and robust |
| [RANGER-3091](https://issues.apache.org/jira/browse/RANGER-3091) | Upgrade solr version in Ranger to Solr 8.6.3 |
| [RANGER-3096](https://issues.apache.org/jira/browse/RANGER-3096) | Upgrade to Kafka 2.5 with kafka_2.12 artifact in Ranger |
| [RANGER-3103](https://issues.apache.org/jira/browse/RANGER-3103) | Ranger KMS should log full UGI principal |
| [RANGER-3105](https://issues.apache.org/jira/browse/RANGER-3105) | Upgrade Ranger Tomcat to 8.5 |
| [RANGER-3109](https://issues.apache.org/jira/browse/RANGER-3109) | Ranger Access audit improvements |
| [RANGER-3118](https://issues.apache.org/jira/browse/RANGER-3118) | Upgrade jackson to 2.11.3 |
| [RANGER-3119](https://issues.apache.org/jira/browse/RANGER-3119) | Upgrade to slf4j 1.7.30 |
| [RANGER-3120](https://issues.apache.org/jira/browse/RANGER-3120) | [Ranger Latest UI] Long tag based service names are not shown correctly |
| [RANGER-3122](https://issues.apache.org/jira/browse/RANGER-3122) | Support delegate-admin for specific permissions |
| [RANGER-3130](https://issues.apache.org/jira/browse/RANGER-3130) | [Ranger Admin UI] Improvement in Ranger Latest UI's Edit Policy Page |
| [RANGER-3131](https://issues.apache.org/jira/browse/RANGER-3131) | Remove some warnings in Maven build output |
| [RANGER-3147](https://issues.apache.org/jira/browse/RANGER-3147) | enhance resource-trie to enable finding evaluators for a given resource and its children |
| [RANGER-3153](https://issues.apache.org/jira/browse/RANGER-3153) | Upgrade to TLS to version 1.2 and above |
| [RANGER-3157](https://issues.apache.org/jira/browse/RANGER-3157) | Improvements for audit details page part-2 |
| [RANGER-3168](https://issues.apache.org/jira/browse/RANGER-3168) | User/Auditor should have read-only access for Servicedef via PublicAPIsv2 API |
| [RANGER-3185](https://issues.apache.org/jira/browse/RANGER-3185) | Docker setup to run Ranger enabled HiveServer2 |
| [RANGER-3186](https://issues.apache.org/jira/browse/RANGER-3186) | [Ranger Access Audit Improvement]Changes done from one user, persists for other users as well. |
| [RANGER-3192](https://issues.apache.org/jira/browse/RANGER-3192) | Use read-write locks for managing access to policy-engine and tag-repository |
| [RANGER-3196](https://issues.apache.org/jira/browse/RANGER-3196) | Docker setup to cache archives to avoid repeated downloads |
| [RANGER-3200](https://issues.apache.org/jira/browse/RANGER-3200) | Ranger KMS - Upgrade api-i18n jar from 1.0.0-M20 to 1.0.2+ |
| [RANGER-3201](https://issues.apache.org/jira/browse/RANGER-3201) | Ranger KMS - Upgrade api-i18n jar from 1.0.0-M20 to 1.0.2+ |
| [RANGER-3202](https://issues.apache.org/jira/browse/RANGER-3202) | Ranger KMS - Upgrade api-i18n jar from 1.0.0-M20 to 1.0.2+ |
| [RANGER-3206](https://issues.apache.org/jira/browse/RANGER-3206) | Enhance db_setup.py to allow reading env variables set in ranger-admin-env scripts |
| [RANGER-3207](https://issues.apache.org/jira/browse/RANGER-3207) | Graceful handling of invalid usernames for usersync |
| [RANGER-3209](https://issues.apache.org/jira/browse/RANGER-3209) | Upgrade netty-all.version 4.1.49.Final to 4.1.60.Final |
| [RANGER-3210](https://issues.apache.org/jira/browse/RANGER-3210) | Upgrade Tomcat to 8.5.63+ |
| [RANGER-3212](https://issues.apache.org/jira/browse/RANGER-3212) | Java client: Support for SSL, kerberos and packaging |
| [RANGER-3213](https://issues.apache.org/jira/browse/RANGER-3213) | Ranger - Upgrade to velocity 2.3 |
| [RANGER-3214](https://issues.apache.org/jira/browse/RANGER-3214) | Configure default audit filters when ranger repo is created |
| [RANGER-3223](https://issues.apache.org/jira/browse/RANGER-3223) | Documentation of Ranger Java Client |
| [RANGER-3227](https://issues.apache.org/jira/browse/RANGER-3227) | Get Exception when visit result of RangerClient.findRoles() |
| [RANGER-3228](https://issues.apache.org/jira/browse/RANGER-3228) | Improvement in audit filter feature |
| [RANGER-3239](https://issues.apache.org/jira/browse/RANGER-3239) | Ranger : Add checkbox for default audit filters on Service Creation page |
| [RANGER-3240](https://issues.apache.org/jira/browse/RANGER-3240) | Show Latest Response from Server on all pages of Ranger UI |
| [RANGER-3246](https://issues.apache.org/jira/browse/RANGER-3246) | Upgrade netty-all version to 4.1.61.Final + |
| [RANGER-3247](https://issues.apache.org/jira/browse/RANGER-3247) | [UI-improvement] Ranger admin audit log does not show service/repo name in the policy operation |
| [RANGER-3250](https://issues.apache.org/jira/browse/RANGER-3250) | Add relevant indexes to database table to speed up ingress processing of tagged entities |
| [RANGER-3251](https://issues.apache.org/jira/browse/RANGER-3251) | [Ranger Audit Filters UI] Tag, KMS service not showing the audit filters in UI section |
| [RANGER-3052](https://issues.apache.org/jira/browse/RANGER-3052) | Cannot search by object name in page /reports/audit/admin |
| [RANGER-3253](https://issues.apache.org/jira/browse/RANGER-3253) | Make incremental policy change computation more resilient |
| [RANGER-3254](https://issues.apache.org/jira/browse/RANGER-3254) | sync source changes when same group is present in different sync source |
| [RANGER-3284](https://issues.apache.org/jira/browse/RANGER-3284) | Simplify processing of tasks scheduled to execute after current transaction is completed |
| [RANGER-3285](https://issues.apache.org/jira/browse/RANGER-3285) | expose user source details in ranger UI |
| [RANGER-3287](https://issues.apache.org/jira/browse/RANGER-3287) | Improve Tagsync authentication error reporting |
| [RANGER-3293](https://issues.apache.org/jira/browse/RANGER-3293) | Show user source details on user tab in ranger UI. |
| [RANGER-3295](https://issues.apache.org/jira/browse/RANGER-3295) | Update Ranger Policy Engine capability matrix |
| [RANGER-3305](https://issues.apache.org/jira/browse/RANGER-3305) | Service version update improvements |
| [RANGER-3306](https://issues.apache.org/jira/browse/RANGER-3306) | Allow comma in policy resource text field. |
| [RANGER-3308](https://issues.apache.org/jira/browse/RANGER-3308) | Create python script to test stability of policy CRUD |
| [RANGER-3309](https://issues.apache.org/jira/browse/RANGER-3309) | Support batch upload of tags to Ranger |
| [RANGER-3324](https://issues.apache.org/jira/browse/RANGER-3324) | Make optimised db schema script idempotent for all DB Flavors. |
| [RANGER-3328](https://issues.apache.org/jira/browse/RANGER-3328) | RANGER-KMS : code improvement |
| [RANGER-3334](https://issues.apache.org/jira/browse/RANGER-3334) | Enhance Ranger admin REST Client to use cookie for policy, tag and role download |
| [RANGER-3339](https://issues.apache.org/jira/browse/RANGER-3339) | Make Ranger Solr audit collection storage configurable |
| [RANGER-3347](https://issues.apache.org/jira/browse/RANGER-3347) | Add default policy for hbase user in hdfs services |
| [RANGER-3349](https://issues.apache.org/jira/browse/RANGER-3349) | Handling multiple grant role command for same user |
| [RANGER-3357](https://issues.apache.org/jira/browse/RANGER-3357) | Ranger HivePlugin Authorization for a new Hive operation |
| [RANGER-3358](https://issues.apache.org/jira/browse/RANGER-3358) | Ranger - Upgrade Tomcat to 8.5.69 |
| [RANGER-3360](https://issues.apache.org/jira/browse/RANGER-3360) | Best Practice: Use updated policy object after pruning the policy object |
| [RANGER-3361](https://issues.apache.org/jira/browse/RANGER-3361) | Ranger Admin : Improve error message while deleting users and groups associated with role. |
| [RANGER-3362](https://issues.apache.org/jira/browse/RANGER-3362) | UI Improvements |
| [RANGER-3363](https://issues.apache.org/jira/browse/RANGER-3363) | Support Session Inactivity Timeout for Ranger |
| [RANGER-3371](https://issues.apache.org/jira/browse/RANGER-3371) | Update algorithm to build Ranger policy-database object from Ranger policy-view object |
| [RANGER-3374](https://issues.apache.org/jira/browse/RANGER-3374) | Syncing 300K+ user group mappings to ranger is causing ranger to go out of memory |
| [RANGER-3376](https://issues.apache.org/jira/browse/RANGER-3376) | Add policy_guid column in x_policy_change_log table |
| [RANGER-3381](https://issues.apache.org/jira/browse/RANGER-3381) | Upgrade to junit 4.13.1 |
| [RANGER-3384](https://issues.apache.org/jira/browse/RANGER-3384) | Metric Get API add input validation |
| [RANGER-3388](https://issues.apache.org/jira/browse/RANGER-3388) | Session Inactivity Timeout: Ranger UI part |
| [RANGER-3396](https://issues.apache.org/jira/browse/RANGER-3396) | RangerPolicyItemRowFilterInfo::toString() method shows "RangerPolicyItemDataMaskInfo" as class name |
| [RANGER-3447](https://issues.apache.org/jira/browse/RANGER-3447) | Ranger startup optimization: reduce number of DB queries to read service-defs |

### Bugs fixed

| JIRA | Summary |
| --- | --- |
| [RANGER-2940](https://issues.apache.org/jira/browse/RANGER-2940) | Added code to update user roles when group memberships are changed with AD/LDAP incremental sync |
| [RANGER-2981](https://issues.apache.org/jira/browse/RANGER-2981) | Unwanted popup display on Security Zone Tab |
| [RANGER-2985](https://issues.apache.org/jira/browse/RANGER-2985) | User with all permission in ranger is not able to update volume |
| [RANGER-2987](https://issues.apache.org/jira/browse/RANGER-2987) | Remove unused ratis jars in ranger admin packaging for ozone plugin |
| [RANGER-2988](https://issues.apache.org/jira/browse/RANGER-2988) | Role Name Search filter is not available on policy listing page |
| [RANGER-2991](https://issues.apache.org/jira/browse/RANGER-2991) | Ranger should close solrclient connection |
| [RANGER-2997](https://issues.apache.org/jira/browse/RANGER-2997) | Ranger usersync role assignment issues |
| [RANGER-3002](https://issues.apache.org/jira/browse/RANGER-3002) | Query info popup stuck in Ranger access audits view |
| [RANGER-3007](https://issues.apache.org/jira/browse/RANGER-3007) | Ozone & Ranger Upgrade: Not able to access volume after Upgrade |
| [RANGER-3014](https://issues.apache.org/jira/browse/RANGER-3014) | Revert RANGER-2789 GET API service/xusers/users turns very slow when there are more than 1000 users |
| [RANGER-3021](https://issues.apache.org/jira/browse/RANGER-3021) | RangerRole Version update is not in correct format in an upgraded cluster |
| [RANGER-3034](https://issues.apache.org/jira/browse/RANGER-3034) | Remove cached policies in plugin if the service is deleted in Ranger admin |
| [RANGER-3037](https://issues.apache.org/jira/browse/RANGER-3037) | Import policy API is not returning proper response in case pre authorization fails |
| [RANGER-3038](https://issues.apache.org/jira/browse/RANGER-3038) | Group memberships not getting updated to ranger |
| [RANGER-3058](https://issues.apache.org/jira/browse/RANGER-3058) | create table fails when ViewDFS(client side HDFS mounting fs) mount points are targeting to Ozone/S3 FS |
| [RANGER-3060](https://issues.apache.org/jira/browse/RANGER-3060) | Maven build failing due to PMD violations |
| [RANGER-3061](https://issues.apache.org/jira/browse/RANGER-3061) | Default configuration error when enable ssl for ranger admin |
| [RANGER-3062](https://issues.apache.org/jira/browse/RANGER-3062) | Even after removing ‘Security Zone’ permission for an user, UI still shows ‘Security Zone’ tab |
| [RANGER-3064](https://issues.apache.org/jira/browse/RANGER-3064) | Make policy API consistent with the UI behavior for keyadmin role |
| [RANGER-3068](https://issues.apache.org/jira/browse/RANGER-3068) | Ranger Usersync is not handling error during initialization process |
| [RANGER-3070](https://issues.apache.org/jira/browse/RANGER-3070) | Add Support for using {OWNER} placeholder in Ozone Ranger Plugin |
| [RANGER-3071](https://issues.apache.org/jira/browse/RANGER-3071) | Supporting character set which is not included in latin1 |
| [RANGER-3073](https://issues.apache.org/jira/browse/RANGER-3073) | Incorrect UI hint message for password validation in FIPS environment |
| [RANGER-3074](https://issues.apache.org/jira/browse/RANGER-3074) | Fix build issues |
| [RANGER-3079](https://issues.apache.org/jira/browse/RANGER-3079) | Fix build failures for ranger-2.2 branch |
| [RANGER-3083](https://issues.apache.org/jira/browse/RANGER-3083) | denyAllElse policy does not handle access request with access-type of '_any' |
| [RANGER-3084](https://issues.apache.org/jira/browse/RANGER-3084) | Ranger database connection fails when postgres is SSL enabled & postgresql-42.2.14 driver jar is used |
| [RANGER-3088](https://issues.apache.org/jira/browse/RANGER-3088) | Build tagged-resource-cache using memory optimization flags identical to policy-cache |
| [RANGER-3090](https://issues.apache.org/jira/browse/RANGER-3090) | KMS setup.sh fails due to blank property value of ranger.ks.db.ssl.certificateFile |
| [RANGER-3093](https://issues.apache.org/jira/browse/RANGER-3093) | Add required libraries to ranger-tools to ensure that perftester scripts run correctly |
| [RANGER-3094](https://issues.apache.org/jira/browse/RANGER-3094) | Ranger HDFS audit not capturing the correct path for write rename operations |
| [RANGER-3095](https://issues.apache.org/jira/browse/RANGER-3095) | not able to list the keys with a user whose id contains non latin character |
| [RANGER-3098](https://issues.apache.org/jira/browse/RANGER-3098) | Updates to validity period of tag are not reflected in Ranger database |
| [RANGER-3101](https://issues.apache.org/jira/browse/RANGER-3101) | Ranger usersync not recovering from initial errors in subsequent syncs |
| [RANGER-3104](https://issues.apache.org/jira/browse/RANGER-3104) | Ranger Hive policy with nested Roles failed to authorize request |
| [RANGER-3107](https://issues.apache.org/jira/browse/RANGER-3107) | Optimize memory requirements for storing Tag/Policy/Zone trie - Trade-off processing time for memory |
| [RANGER-3112](https://issues.apache.org/jira/browse/RANGER-3112) | Ranger usersync unit test cases are failing on mac |
| [RANGER-3117](https://issues.apache.org/jira/browse/RANGER-3117) | Need feature to capture URL of a particular instance of audit event |
| [RANGER-3121](https://issues.apache.org/jira/browse/RANGER-3121) | HBase list command authorization issue in Ranger |
| [RANGER-3124](https://issues.apache.org/jira/browse/RANGER-3124) | Search filter with user name having non latin character is not working on Audit>>Access tab |
| [RANGER-3129](https://issues.apache.org/jira/browse/RANGER-3129) | Python client uses incorrect default value assignment for method parameters |
| [RANGER-3134](https://issues.apache.org/jira/browse/RANGER-3134) | Remove global JAAS Configuration for Ranger auditing to SOLR |
| [RANGER-3140](https://issues.apache.org/jira/browse/RANGER-3140) | Ranger ShutdownHook hook to be called in RangerHBaseCoprocessor preShutdown apis for a clean shutdown of HBase |
| [RANGER-3143](https://issues.apache.org/jira/browse/RANGER-3143) | Ranger usersync, user group mapping for user deletion is not syncing up, if only one user is present in the group |
| [RANGER-3149](https://issues.apache.org/jira/browse/RANGER-3149) | Adding exisitng policy check for PatchForKafkaServiceDefUpdate_J10033 |
| [RANGER-3156](https://issues.apache.org/jira/browse/RANGER-3156) | RangerResouceTrie.add() and RangerResourceTrie.delete() do not work correctly for the resources containing wildcards |
| [RANGER-3159](https://issues.apache.org/jira/browse/RANGER-3159) | Having any permission on hbase tables should allow listing of tables |
| [RANGER-3163](https://issues.apache.org/jira/browse/RANGER-3163) | Ranger Database deadlock when Service creation and user sync are running parallel |
| [RANGER-3169](https://issues.apache.org/jira/browse/RANGER-3169) | Ranger Usersync config for keystore type and truststore type for LDAPS are not effective |
| [RANGER-3171](https://issues.apache.org/jira/browse/RANGER-3171) | Ranger ui became broken after logout in Firefox |
| [RANGER-3172](https://issues.apache.org/jira/browse/RANGER-3172) | Patch to migrate old policy to use new Policy Ref table |
| [RANGER-3175](https://issues.apache.org/jira/browse/RANGER-3175) | Add back the support to provide option to retrieve users from group member attribute |
| [RANGER-3178](https://issues.apache.org/jira/browse/RANGER-3178) | Fix spurious full policy/tag downloads when incremental policy/tag updates are enabled |
| [RANGER-3187](https://issues.apache.org/jira/browse/RANGER-3187) | Roles download failed in Ranger after upgrade |
| [RANGER-3190](https://issues.apache.org/jira/browse/RANGER-3190) | Skip python unit tests if requests library not present |
| [RANGER-3194](https://issues.apache.org/jira/browse/RANGER-3194) | Ranger Access Audits page not loading |
| [RANGER-3199](https://issues.apache.org/jira/browse/RANGER-3199) | illegal reflective access operation warning in KMS catalina.out logs |
| [RANGER-3203](https://issues.apache.org/jira/browse/RANGER-3203) | Add back the support to provide option to retrieve groups from user memberof attribute |
| [RANGER-3205](https://issues.apache.org/jira/browse/RANGER-3205) | Policy Item not render in report page |
| [RANGER-3207](https://issues.apache.org/jira/browse/RANGER-3207) | Graceful handling of invalid usernames for usersync |
| [RANGER-3208](https://issues.apache.org/jira/browse/RANGER-3208) | NPE in Ranger policy engine when processing SELF_OR_CHILD scoped search |
| [RANGER-3218](https://issues.apache.org/jira/browse/RANGER-3218) | User getting denied even after having tag based policy |
| [RANGER-3220](https://issues.apache.org/jira/browse/RANGER-3220) | Zone name is not getting populated for tag based policy. |
| [RANGER-3224](https://issues.apache.org/jira/browse/RANGER-3224) | Not able to delete security-zone |
| [RANGER-3229](https://issues.apache.org/jira/browse/RANGER-3229) | Correct Kafka default policy item for all-delegation token and rangerlookup user |
| [RANGER-3233](https://issues.apache.org/jira/browse/RANGER-3233) | Ranger Kafka Plugin changes to get the UGI from Kafka client JAAS config instead of Subject from Kafka LoginManager |
| [RANGER-3234](https://issues.apache.org/jira/browse/RANGER-3234) | Ranger db patch no 045 is failing for oracle db. |
| [RANGER-3235](https://issues.apache.org/jira/browse/RANGER-3235) | Remove hive-exec dependency from Ranger audit frame work |
| [RANGER-3238](https://issues.apache.org/jira/browse/RANGER-3238) | Incorrect response for 'ranger_metric denyconditions' in Collect Diagnostic Data |
| [RANGER-3252](https://issues.apache.org/jira/browse/RANGER-3252) | Inconsistent behavior in Ranger Role authorization with in same hive beeline session |
| [RANGER-3259](https://issues.apache.org/jira/browse/RANGER-3259) | [Ranger Audit Filter] Ranger role is allowed to delete, even if its used in audit filters |
| [RANGER-3260](https://issues.apache.org/jira/browse/RANGER-3260) | Update default hdfs audit filters to filter out unwanted audits |
| [RANGER-3261](https://issues.apache.org/jira/browse/RANGER-3261) | Remove unused .htaccess file from component |
| [RANGER-3262](https://issues.apache.org/jira/browse/RANGER-3262) | Ranger group memberships are not working for LDAP sync |
| [RANGER-3263](https://issues.apache.org/jira/browse/RANGER-3263) | libthrift 0.14.x exclude tomcat-embed-core from dependency |
| [RANGER-3264](https://issues.apache.org/jira/browse/RANGER-3264) | [Solr Ranger Plugin] Add support/Fix Test connection with Solr service |
| [RANGER-3266](https://issues.apache.org/jira/browse/RANGER-3266) | Solr inter-node communication not working after enabling Ranger |
| [RANGER-3268](https://issues.apache.org/jira/browse/RANGER-3268) | Ranger Audit filter should filter audits that are created by Hive Role command operations |
| [RANGER-3272](https://issues.apache.org/jira/browse/RANGER-3272) | Zone tag policies are getting deleted when zone is updated |
| [RANGER-3275](https://issues.apache.org/jira/browse/RANGER-3275) | Need to update solr-config.xml in the ranger-audits collection config-set |
| [RANGER-3277](https://issues.apache.org/jira/browse/RANGER-3277) | Number of users/groups marked for delete are not shown in logs |
| [RANGER-3280](https://issues.apache.org/jira/browse/RANGER-3280) | Ensure that the policy/tag versions gets correctly updated for every change to service/policy/tag |
| [RANGER-3286](https://issues.apache.org/jira/browse/RANGER-3286) | Oracle upgrade fails with oracle: SQLSyntaxErrorException in 052-add-unique-constraint-on-change-logs |
| [RANGER-3288](https://issues.apache.org/jira/browse/RANGER-3288) | Ranger Audit Filters doesn't filter hdfs read operation when filter is set to not audit read |
| [RANGER-3291](https://issues.apache.org/jira/browse/RANGER-3291) | NPE in BasePlugin if the first policy download contains no policies and no policy-deltas |
| [RANGER-3292](https://issues.apache.org/jira/browse/RANGER-3292) | Fix ConcurrentModificationException from RangerTransactionSynchronizationAdapter |
| [RANGER-3294](https://issues.apache.org/jira/browse/RANGER-3294) | AccessResult attribute with isAudited as false not filtered in Ranger Audit Filter |
| [RANGER-3297](https://issues.apache.org/jira/browse/RANGER-3297) | Internal user is not marked as external after the user sync source details are changed |
| [RANGER-3301](https://issues.apache.org/jira/browse/RANGER-3301) | [UI] in admin audit log tables not formatted correctly for long string value for resources. |
| [RANGER-3304](https://issues.apache.org/jira/browse/RANGER-3304) | Create solr audit conf zip archive |
| [RANGER-3311](https://issues.apache.org/jira/browse/RANGER-3311) | Ranger Usersync not retrying failed updates for unix or file sync source |
| [RANGER-3312](https://issues.apache.org/jira/browse/RANGER-3312) | Role is getting removed from policy when user present in that policy is deleted |
| [RANGER-3320](https://issues.apache.org/jira/browse/RANGER-3320) | ranger tags are not added for when tagging identically named database/tables in two different Ranger services |
| [RANGER-3322](https://issues.apache.org/jira/browse/RANGER-3322) | remove grant of public synonym privileges for oracle db |
| [RANGER-3323](https://issues.apache.org/jira/browse/RANGER-3323) | Ranger Hive Table lookup is not working |
| [RANGER-3325](https://issues.apache.org/jira/browse/RANGER-3325) | Roles information not present in the Excel and CSV files which are downloaded from Reports page |
| [RANGER-3333](https://issues.apache.org/jira/browse/RANGER-3333) | Ozone Ranger Audits are not showing up in Ranger Admin UI for "om" service user |
| [RANGER-3336](https://issues.apache.org/jira/browse/RANGER-3336) | All policies are exported, when searching reports using roles |
| [RANGER-3337](https://issues.apache.org/jira/browse/RANGER-3337) | Ranger policy not taking effect with HDFS Snapshots |
| [RANGER-3338](https://issues.apache.org/jira/browse/RANGER-3338) | Masking and Row filter policy are getting exported from report page when Policy type=Access |
| [RANGER-3341](https://issues.apache.org/jira/browse/RANGER-3341) | External user's role creation may fail in certain version of MariaDB |
| [RANGER-3343](https://issues.apache.org/jira/browse/RANGER-3343) | Ranger policy cache is incorrect in some scenario |
| [RANGER-3344](https://issues.apache.org/jira/browse/RANGER-3344) | Ranger Admin fails to start with java.lang.NoClassDefFoundError: org/apache/htrace/core/Tracer$Builder |
| [RANGER-3345](https://issues.apache.org/jira/browse/RANGER-3345) | Default Ranger policy for KMS should include "om" user for Ozone bucket level encryption to work |
| [RANGER-3350](https://issues.apache.org/jira/browse/RANGER-3350) | Ranger HivePluginAuthorizer SHOW CURRENT ROLES not fetching the role set in current hive beeline session |
| [RANGER-3351](https://issues.apache.org/jira/browse/RANGER-3351) | Incorrect hive query displayed for grant and revoke role command |
| [RANGER-3353](https://issues.apache.org/jira/browse/RANGER-3353) | Show roles is not listing all roles |
| [RANGER-3355](https://issues.apache.org/jira/browse/RANGER-3355) | Ranger Admin : Update the current logging mechanism to use custom log4j conf |
| [RANGER-3366](https://issues.apache.org/jira/browse/RANGER-3366) | Cluster type is missed in copy constructor of RangerAccessRequestImpl |
| [RANGER-3367](https://issues.apache.org/jira/browse/RANGER-3367) | [Intermittent] Ranger Admin perf logs are not getting logged after Spring Security upgrade |
| [RANGER-3372](https://issues.apache.org/jira/browse/RANGER-3372) | Issue in policies search on report page with user having more than one unix group |
| [RANGER-3385](https://issues.apache.org/jira/browse/RANGER-3385) | Duplicate SQL prefix should not be allowed |
| [RANGER-3387](https://issues.apache.org/jira/browse/RANGER-3387) | Ranger Admin Header Validation |
| [RANGER-3398](https://issues.apache.org/jira/browse/RANGER-3398) | Duplicate JAVA patch suffix should not be allowed |
| [RANGER-3404](https://issues.apache.org/jira/browse/RANGER-3404) | user with no permissions can access and edit delegate admin only policies |
| [RANGER-3419](https://issues.apache.org/jira/browse/RANGER-3419) | compressDeltas method returns two ranger policy entries for policy create+update case when provided lastKnownVersion is previous to create call |
| [RANGER-3441](https://issues.apache.org/jira/browse/RANGER-3441) | PropertiesUtil (Admin) logging potentially sensitive data |
| [RANGER-3446](https://issues.apache.org/jira/browse/RANGER-3446) | log4j initialization failure in docker setup |
| [RANGER-3455](https://issues.apache.org/jira/browse/RANGER-3455) | [Logout-Ranger] Should either be disabled/ should redirect to knox logout page |
| [RANGER-3462](https://issues.apache.org/jira/browse/RANGER-3462) | User with delegated admin permission on a resource cannot fetch policy for the resource |
| [RANGER-3480](https://issues.apache.org/jira/browse/RANGER-3480) | Policy version in access audit is not matching with the policy version seen in policy view |
| [RANGER-3481](https://issues.apache.org/jira/browse/RANGER-3481) | Incremental policy updates do not work correctly for multiple security zones |
| [RANGER-3489](https://issues.apache.org/jira/browse/RANGER-3489) | Add htrace-core.jar as dependency for various Ranger Plugins |

## Further reading

- [Apache Ranger 2.2.0 - Release Notes (cwiki)](https://cwiki.apache.org/confluence/display/RANGER/Apache+Ranger+2.2.0+-+Release+Notes)
- [All issues with fixVersion 2.2.0 in JIRA](https://issues.apache.org/jira/issues/?jql=project%20%3D%20RANGER%20AND%20fixVersion%20%3D%202.2.0)
- [Release index](index.md) and [Download and verify](download.md)