Implement Apache Ranger Authorization Plugin for Apache Polaris (#274) by sneethiraj · Pull Request #3928 · apache/polaris

sneethiraj · 2026-03-04T06:20:46Z

RFC : https://docs.google.com/document/d/10UIpPMeWVU3VA0goGz_y8OAbXhIDigah/edit?usp=sharing&ouid=103452742845206345322&rtpof=true&sd=true

This RFC proposes integrating Apache Ranger as an external authorization plugin for Apache Polaris by implementing the PolarisAuthorizer SPI. By leveraging Ranger’s mature ecosystem, Polaris can provide enterprises with centralized policy management, fine-grained resource-based access control (RBAC/ABAC), and comprehensive audit logging without replacing its internal authorization model. This integration addresses key enterprise challenges by providing a uniform, centralized security and governance platform for policy management and data access auditing.

Checklist

🛡️ Don't disclose security issues! (contact security@apache.org)
🔗 Clearly explained why the changes are needed, or linked related issues: Fixes #
🧪 Added/updated tests with good coverage, or manually tested (and explained how)
💡 Added comments for complex logic
🧾 Updated CHANGELOG.md (if needed)
📚 Updated documentation in site/content/in-dev/unreleased (if needed)

…e#274)

…classes into RangerUtils class

added unit tests to verify operations on ROOT and CATALOG renamed ranger-plugin.properties to ranger-authorizer.properties

…ined or non-ranger-auth

…d fixed some validations on permissions for targets/secondaries

…the permissions requested

…or secondaries - but, secondary objects are being passed on.

replaced multiple authz requests with a single request

…licies

…ll] and [gradlew check]

…horizer interface

adutra · 2026-03-16T10:05:57Z

runtime/defaults/src/main/resources/application.properties


 # force the locale, just in case the system's using another default locale
 quarkus.default-locale=en_US
-


ni: spurious change.

Addressed in e6482c0.

adutra · 2026-03-16T10:10:37Z

gradle/libs.versions.toml

 caffeine = { module = "com.github.ben-manes.caffeine:caffeine", version = "3.2.3" }
 cel-bom = { module = "org.projectnessie.cel:cel-bom", version = "0.6.0" }
 checkstyle = { module = "com.puppycrawl.tools:checkstyle", version.ref = "checkstyle" } # required by the polaris-java plugin
+commons-collections = { module = "commons-collections:commons-collections", version = "3.2.2" }


These two new dependencies seem unused.

Addressed in e6482c0.

adutra · 2026-03-16T10:10:54Z

extensions/auth/ranger/build.gradle.kts

+    exclude("org.apache.hadoop", "hadoop-client-api")
+    exclude("org.apache.hadoop", "hadoop-client-runtime")
+  }
+  implementation(libs.commons.lang3)


commons-lang seems unused.

commons.lang3 is used in RangerPolarisAuthorizerFactory and RangerUtils.

adutra · 2026-03-16T10:11:27Z

extensions/auth/ranger/build.gradle.kts

+  implementation(libs.graalvm.js.js.scriptengine)
+  implementation(libs.graalvm.polyglot.js)
+  implementation(libs.graalvm.polyglot.polyglot)


All GraalVM dependencies seem unused, did you mean to use runtimeOnly instead?

Yes, that is correct; will change dependency to runtimeOnly. Thank you.

Addressed in e6482c0.

adutra · 2026-03-16T10:12:25Z

extensions/auth/ranger/src/test/resources/authz_tests/ranger-plugin-invalid.properties

@@ -0,0 +1,26 @@
+#


This file seems unused.

Addressed in e6482c0.

adutra · 2026-03-16T10:12:33Z

extensions/auth/ranger/src/test/resources/authz_tests/ranger-plugin.properties

@@ -0,0 +1,25 @@
+#


This file seems unused.

Addressed in e6482c0.

adutra · 2026-03-16T10:15:01Z

...nger/src/test/java/org/apache/polaris/extension/auth/ranger/TestRangerPolarisAuthorizer.java

+import org.apache.polaris.core.persistence.ResolvedPolarisEntity;
+import org.junit.jupiter.api.Test;
+
+public class TestRangerPolarisAuthorizer {


Nit: the naming convention in Polaris is: RangerPolarisAuthorizerTest. Same for RangerPolarisAuthorizerFactoryTest.

Addressed in e6482c0.

adutra · 2026-03-16T10:17:22Z

...ions/auth/ranger/src/test/java/org/apache/polaris/extension/auth/ranger/RangerTestUtils.java

+import org.apache.polaris.core.entity.CatalogEntity;
+
+public class RangerTestUtils {
+  public static RangerPolarisAuthorizerConfig createConfig() {


Have you considered writing @QuarkusTests rather than pure unit tests instead? The advantage is that you don't need to create all the fixtures, and you would be testing the "real thing".

I haven't tried @QuarkusTest yet; can this be taken up in a follow-up PR? I would prefer to retain current light-weight unit tests though.

adutra · 2026-03-16T10:20:25Z

...nger/src/test/java/org/apache/polaris/extension/auth/ranger/RangerPolarisAuthorizerTest.java

+
+  @Test
+  public void testAuthzRoot() throws Exception {
+    runTests(authorizer, "/authz_tests/tests_authz_root.json");


nit: what is the advantage of writing your test cases as JSON, just to have them mapped to Java beans with Jackson? Isn't it simpler to just write your test cases in Java, maybe with parameterized tests? Especially given the significant amount of boilerplate code related to Jackson deserialization that needs to be introduced.

I think capturing test input/output in Json format makes it easier to focus on test details, without any scaffolding distractions while doing the same in Java.

Quite frankly, something like this would be way more readable imho:

@ParameterizedTest @CsvSource({ "CREATE_CATALOG , admin1 , ROOT:root_container , true", "LIST_CATALOGS , admin1 , ROOT:root_container , true", "CREATE_PRINCIPAL , admin1 , ROOT:root_container , true", "LIST_PRINCIPALS , admin1 , ROOT:root_container , true", "CREATE_CATALOG , user1 , ROOT:root_container , false", "LIST_CATALOGS , user1 , ROOT:root_container , true", "CREATE_PRINCIPAL , user1 , ROOT:root_container , false", "LIST_PRINCIPALS , user1 , ROOT:root_container , true", "CREATE_CATALOG , user2 , ROOT:root_container , false", "LIST_CATALOGS , user2 , ROOT:root_container , false", "CREATE_PRINCIPAL , user2 , ROOT:root_container , false", "LIST_PRINCIPALS , user2 , ROOT:root_container , false", }) void testAuthzRoot( PolarisAuthorizableOperation authzOp, String principalName, String target, boolean isAllowed) { assertAuthz(authzOp, principalName, target, null, isAllowed); }

@adutra - ok, thanks for the sample. Unless this is a blocker, I would prefer to retain current unit tests.

mneethiraj · 2026-03-18T01:15:15Z

@adutra, @dimas-b, @flyingImer, @flyrain - thank you all so much for the thoroughness in reviewing the PR and suggestions. Are there any blocker items to address before this PR approved and merged?

flyrain · 2026-03-19T02:05:52Z

Thanks @mneethiraj for working on it. LGTM overall. I'd suggest to file issues for followups and fix the CI failures.

adnanhemani

Thanks all for the thorough reviews. I just took a look and everything looks about right except the few outstanding comments, which I believe are all for follow up items.

There's a failure in the CI, relating to Licenses and Notices. Once that's taken care of, I'd be ready to approve!

Thank you for this great work, @sneethiraj!

mneethiraj · 2026-03-19T08:43:38Z

Thanks @mneethiraj for working on it. LGTM overall. I'd suggest to file issues for followups and fix the CI failures.

Thanks @flyrain. I updated the LICENSE file to address failures in polaris-server:generateLicenseReport. Now, CI fails with the following.

{
    "dependenciesWithoutAllowedLicenses": [
        {
            "moduleName": "org.graalvm.shadowed:icu4j",
            "moduleLicense": "Unicode/ICU License",
            "moduleVersion": "25.0.2"
        }
    ]
}

@flyrain, @adutra, @dimas-b - can you please review and confirm that this license is indeed not allowed? If its not allowed, the only option seems to exclude this library. It seems excluding this library can result in failures in locale-specific handling of custom expressions in Ranger policies. Though this issue may not impact most use cases of Ranger policies, needs to be investigated further and documented.

…tions (apache#274)

…63e75ca

flyrain · 2026-03-19T16:25:16Z

Unicode license is OK to include, https://www.apache.org/legal/resolved.html#category-a. We need to update the license checker.

This reverts commit 65fa58e.

…dancies

sneethiraj · 2026-03-19T17:53:37Z

Thanks @adnanhemani for your efforts to review and provide valuable comments!

… issues from CI/PR

mneethiraj · 2026-03-19T20:48:42Z

Unicode license is OK to include, https://www.apache.org/legal/resolved.html#category-a. We need to update the license checker.

Thanks @flyrain. Apart from above failure from ./gradlew :polaris-server:checkLicense, there are no more CI issues for this PR. This CI failure would be addressed once the licensr checker is updated to allow Unicode/ICU License. @dimas-b, @jbonofre - will you be able to help with this please? Thanks!

sneethiraj and others added 27 commits February 24, 2026 20:56

Added support for Apache Ranger Authorizer in Apache Polaris - (apach…

64fbde5

…e#274)

Fixed sample configuration to refer logical service names (apache#274)

0f86112

cleanup properties file and Java sources

432f26e

merged RangerPolarisPlugin in RangerPolarisAuthorizer, model package …

da97281

…classes into RangerUtils class

Merge branch 'apache:main' into main

19148b9

updated authorizer to handle permissions on secondaries

eb48654

added unit tests to verify operations on ROOT and CATALOG renamed ranger-plugin.properties to ranger-authorizer.properties

unit tests added for authorization on principals

d845fb4

unit tests added for authorization on principal-roles

4237c5e

unit test assert message updated

89192fc

unit tests added for authorization on namespaces

19acfda

unit tests added for authorization on catalog-roles

ade4c33

unit tests added for authorization on tables

86b9bda

unit tests added for authorization on policies

ec712a4

modified configuration to be optional if the authorization is not def…

b3f5c5f

…ined or non-ranger-auth

fixed the ranger-plugin.properties filename - sync with README.txt an…

3253514

…d fixed some validations on permissions for targets/secondaries

added precheck to ensure that the objects are available for checking …

e8f0469

…the permissions requested

added to call config validation from RangerAuthorizerFactory

555499d

modified to send a WARN log message when privleges are not provided f…

15dcd75

…or secondaries - but, secondary objects are being passed on.

Added error messages to identify configuration/initialization issues

970256a

added user and resource attributes to Ranger access request

896de51

updated Ranger version from 2.8.0-SNAPSHOT to 2.8.0

0d824d8

replaced multiple authz requests with a single request

updated handling of unsupported operations

066f3d7

updated tests to rename config file and update service-def in test po…

7c7570f

…licies

removed an unwanted configuration file

6adf189

Fixed few formatting issues found by command [gradlew format compileA…

43f3b88

…ll] and [gradlew check]

Merge branch 'apache:main' into main

4101bf6

added new authorizer methods to support the new version of PolarisAut…

e4f1ccc

…horizer interface

github-project-automation bot added this to Basic Kanban Board Mar 4, 2026

github-project-automation bot moved this to PRs In Progress in Basic Kanban Board Mar 4, 2026

fixed a formatting issue from [gradlew format compileAll] command

f660a56

mneethiraj added 2 commits March 13, 2026 15:04

read Ranger authorizer configurations from application.properties

68870f0

excluded hadoop-client-api and hadoop-client-runtime dependencies

40ed676

adutra reviewed Mar 16, 2026

View reviewed changes

mneethiraj added 3 commits March 16, 2026 07:53

Merge branch 'apache:main' into main

7ccf2fb

addressed review suggestions

e6482c0

Merge branch 'apache:main' into main

83ffec5

Merge branch 'apache:main' into main

510886e

Merge branch 'apache:main' into main

f994fb9

mneethiraj mentioned this pull request Mar 19, 2026

Eliminate duplicate pre-condition checks while handling operations ROTATE_CREDENTIALS and RESET_CREDENTIALS across authorizer implementations #4026

Open

adnanhemani reviewed Mar 19, 2026

View reviewed changes

mneethiraj added 2 commits March 19, 2026 00:20

updated LICENSE file for Ranger authorizer

bc12117

updated LICENSE file for Ranger authorizer

a75f99b

sneethiraj and others added 6 commits March 19, 2026 09:56

duplicate key entry of ranger has been addressed for ranger configura…

9c3fcea

…tions (apache#274)

Merge branch 'apache:main' into main

383cbce

removed ranger authorizer devtest configuration

c7cd533

modified to remove all operation that were removed as part of commit - …

5d6d1d6

…63e75ca

modified the code to follow standards (review from spotlessApply)

4c9457d

dependent libary for the audit provider is added

65fa58e

sneethiraj and others added 3 commits March 19, 2026 13:37

Revert "dependent libary for the audit provider is added"

255113d

This reverts commit 65fa58e.

excluded hadoop audit destination module to avoid bringing more depen…

647bafd

…dancies

Merge branch 'apache:main' into main

eb2ad40

mneethiraj and others added 3 commits March 19, 2026 11:52

Merge branch 'apache:main' into main

64b5357

fixed a LICENSE file mention that was not used anymore and formatting…

f25ddbb

… issues from CI/PR

Merge branch 'main' of github.com:sneethiraj/polaris

1b0b5e2


		# force the locale, just in case the system's using another default locale
		quarkus.default-locale=en_US

Conversation

sneethiraj commented Mar 4, 2026

Checklist

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mneethiraj commented Mar 18, 2026

Uh oh!

flyrain commented Mar 19, 2026

Uh oh!

adnanhemani left a comment

Choose a reason for hiding this comment

Uh oh!

mneethiraj commented Mar 19, 2026

Uh oh!

flyrain commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sneethiraj commented Mar 19, 2026

Uh oh!

mneethiraj commented Mar 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

flyrain commented Mar 19, 2026 •

edited

Loading