Apache Ranger is a framework for centralized, fine-grained authorization and auditing across data and AI platforms. Policies are managed in one place, Ranger Admin, through its web UI or REST API, and are enforced by Ranger plugins inside the protected services, which also record an audit trail of access decisions. Policies can be based on resources, tags or attributes, and can filter rows and mask columns.
Documentation, release notes and downloads: https://ranger.apache.org/
Released versions of Ranger Admin are published on Docker Hub as
apache/ranger. It runs with a database,
apache/ranger-db (PostgreSQL), and an audit store,
apache/ranger-solr; the apache/ranger page has the commands to
start all three. Then open http://localhost:6080 and log in as admin / rangerR0cks!.
These images are for evaluation and development; they use well-known default passwords.
Ranger Admin stores policies; each service enforces them through a Ranger plugin that runs inside it. To protect a service, set up its plugin. The plugin downloads the service's policies from Ranger Admin, authorizes each request locally and sends audit events to the audit store.
| Service | Plugin runs in | Plugin ships with |
|---|---|---|
| Apache Polaris | Polaris server | Apache Polaris |
| Trino | Trino coordinator | Trino |
| Apache Impala | impalad and catalogd |
Apache Impala |
| Apache Ozone | Ozone Manager | Apache Ranger |
| Apache Kudu | Kudu master | Apache Kudu |
| Schema Registry | Schema Registry server | Schema Registry |
| Presto | Presto coordinator | Apache Ranger |
| Elasticsearch | Elasticsearch nodes | Apache Ranger |
| Apache Kylin | Kylin server | Apache Ranger |
| Apache Sqoop | Sqoop 2 server | Apache Ranger |
| Apache NiFi Registry | NiFi Registry server | Apache NiFi |
| Apache NiFi | NiFi nodes | Apache NiFi |
| Apache Atlas | Atlas server | Apache Ranger |
| Apache Kafka | Kafka brokers | Apache Ranger |
| Apache Solr | Solr nodes | Apache Ranger |
| Apache Ranger KMS | Ranger KMS server | Apache Ranger |
| Apache Hadoop YARN | ResourceManager | Apache Ranger |
| Apache Knox | Knox gateway | Apache Ranger |
| Apache Storm | Nimbus | Apache Ranger |
| Apache HBase | HBase Master and RegionServers | Apache Ranger |
| Apache Hive | HiveServer2 | Apache Ranger |
| Apache Hadoop HDFS | NameNode | Apache Ranger |
Plugins that ship with Apache Ranger are released as ranger-<version>-<service>-plugin.tar.gz archives, also
written to target/ by a source build; the KMS plugin is part of this repo. The other services ship the
plugin themselves and enable it in their own configuration. Applications not listed above can authorize requests
with the Ranger authorization API (authz-api), either evaluating policies in process (authz-embedded) or
sending each request to the PDP server (authz-remote, available from the 2.9 release onwards).
- Linux or macOS
- JDK 17
- Apache Maven 3.6.3 or newer
- Git
- Python 3, for the Python client tests (not needed with
-DskipTests) - Docker with Compose v2, only to build or run Ranger in containers
git clone https://github.com/apache/ranger.git
cd ranger
mvn clean install # full build: unit tests and code checks
mvn clean package -DskipTests # faster: skips unit tests and code checksThe build writes a ranger-<version>-<component>.tar.gz archive for each service, plugin and tool to target/,
for example ranger-<version>-admin.tar.gz.
To build without a local JDK or Maven, use the build container in
dev-support/ranger-docker; it writes
the archives to dev-support/ranger-docker/dist/.
To work in an IDE, open the root pom.xml as a Maven project. An IntelliJ IDEA code style scheme is in
dev-support/RangerCodeScheme-IntelliJ.xml.
dev-support/ranger-docker builds images from these archives and runs
Ranger Admin with its database and audit store, the other Ranger services, and services with Ranger plugins
enabled, such as Trino, Ozone, Kafka, Hive and HBase. CI uses the same setup. Its README has the steps; like the
Docker Hub images, it is meant for development only.
Contributions are accepted as GitHub pull requests.
- Find or file an issue in the RANGER JIRA project. Discuss larger changes on dev@ranger.apache.org first.
- Open a pull request against
mastertitledRANGER-XXXX: <subject>and fill in the template. - Keep CI green. It runs
mvn clean verifyon JDK 17 (unit tests, checkstyle, PMD, SpotBugs, RAT) and checks that the Docker containers start.
A committer merges the pull request once it is approved. See the contributing guide and the code style guide.
Report suspected vulnerabilities privately to security@apache.org, not in JIRA, GitHub or the mailing lists. See SECURITY.md.
- Questions about using Ranger: user@ranger.apache.org (subscribe)
- Development: dev@ranger.apache.org (subscribe)
- Chat: Ranger channel on the ASF Slack
- Issues: RANGER JIRA project
Apache Ranger is licensed under the Apache License, Version 2.0.