Ranger Admin¶
Ranger Admin is the central service of Apache Ranger. It is the place where security administrators define who may do what on which data, and where auditors go to see what actually happened. Everything else in Ranger either feeds Admin (UserSync, TagSync) or takes instructions from it: the plugins that run inside protected services such as Apache Polaris, Trino, Ozone, Kafka, Hive and HDFS, and the PDP server that answers authorization requests for any other application.
Admin is a single Java web application. It embeds its own Tomcat server, exposes a React-based web UI and a REST API, and keeps all of its state in a relational database. Plugins never talk to the database; they download policies from Admin over HTTP(S) and keep a local copy, so a temporary Admin outage does not stop authorization in the protected services.
What Ranger Admin does¶
- Policy administration
- Create and manage service definitions, services, resource-based and tag-based policies, row-filter and masking policies, security zones and Governed Data Sharing objects.
- Policy distribution
- Serves versioned policy, tag, role and user-store downloads to plugins
(
/service/plugins/policies/download/...,/service/tags/download/...,/service/roles/download/...). - Identity store
- Holds portal users and their roles, plus the users and groups synced by UserSync and referenced in policies.
- Audit viewer
- Queries the configured audit store (Solr, Elasticsearch, OpenSearch or CloudWatch) and shows access audits, admin changes, login sessions, plugin downloads and plugin status.
- Key administration
- Hosts the Key Manager UI for Ranger KMS (users with the KeyAdmin role).
- Operational surface
- Health endpoints, Prometheus and JSON metrics, REST API for automation.
How it works¶
flowchart LR
UI[Web UI / REST clients] -->|HTTPS 6182 / HTTP 6080| ADMIN[Ranger Admin]
US[UserSync] -->|users and groups| ADMIN
TS[TagSync] -->|tags| ADMIN
ADMIN -->|JDBC| DB[(Policy database)]
ADMIN -->|queries| AUD[(Audit store)]
P1[Plugin in Trino] -->|poll policies, tags, roles| ADMIN
P2[Plugin in HiveServer2] -->|poll policies, tags, roles| ADMIN
P1 -->|audit events| AUD
P2 -->|audit events| AUD
Inside the process:
- Embedded web server (
embeddedwebservermodule,org.apache.ranger.server.tomcat.EmbeddedServer) starts Tomcat, opens the HTTP/HTTPS connectors and, on start-up, bootstraps the Solr collection, Elasticsearch or OpenSearch index used for audits. - Spring Security filter chain (
security-applicationContext.xml) authenticates requests using the configured method: local database, PAM, LDAP, Active Directory, Kerberos/SPNEGO, Knox SSO, JWT bearer tokens or trusted headers. See Authentication. - REST layer (
org.apache.ranger.rest.*) implements the API under/service/...; the UI is only a client of that API. See the REST API overview. - Persistence uses JPA (EclipseLink) over MySQL, PostgreSQL, Oracle, SQL Server or SQL Anywhere. Schema creation and upgrades are handled by numbered SQL and Java patches. See Database.
- Metrics are exported through the
ranger-metricsmodule in Prometheus and JSON formats. See Metrics.
Default ports¶
| Port | Property | Purpose |
|---|---|---|
| 6080 | ranger.service.http.port |
HTTP UI and REST API |
| 6182 | ranger.service.https.port |
HTTPS UI and REST API, replaces the HTTP port when ranger.service.https.attrib.ssl.enabled=true |
| 6085 | ranger.service.shutdown.port |
Tomcat shutdown port, local use only |
Default accounts¶
The database schema creates four portal users. In the dev-support/ranger-docker setup their passwords are
set from the RANGER_*_PASSWORD variables in .env when the database is first prepared; all default to
rangerR0cks!. Change the passwords before the deployment is exposed to users; see
Security hardening.
| Login | Role | Used by |
|---|---|---|
admin |
Admin | Human administrators, first login |
rangerusersync |
Admin | UserSync when it pushes users and groups |
rangertagsync |
Admin | TagSync when it pushes tags |
keyadmin |
KeyAdmin | Ranger KMS key administration |
Pages in this section¶
- Deployment and configuration: running Admin with Docker and
ranger-admin-services.sh,ranger-admin-site.xmlreference, logs, upgrade - Authentication: every login method for the UI and REST API, with the properties that control each
- Users, groups and roles: internal and external users, admin roles, read-only auditors, permissions module, deleting users
- Database: supported databases, schema and patch mechanism, connection pool, SSL to the database, backup and restore
- High availability: running several Admin instances behind a load balancer and how plugins cope with outages
- Security hardening: lock-down checklist, HTTPS, plugin-to-Admin SSL, credential store, CSRF and password policy
- Admin UI guide: a tour of Service Manager, policies, audits, settings, zones, reports and Governed Data Sharing
- Metrics: Prometheus and JSON metrics, JVM and container metrics, audit metrics, CLI metric collection
Where to start¶
-
To try Ranger quickly, run it with Docker. Both ways are described step by step in Run with Docker:
Released images
apache/ranger,apache/ranger-dbandapache/ranger-solr(tags up to2.9.0): Ranger Admin with a PostgreSQL database and a standalone Solr audit store.Images built from the source tree with
docker-compose.ranger.ymlanddocker-compose.ranger-audit-service.yml: Ranger Admin, the database selected withRANGER_DB_TYPE, Kafka, OpenSearch, the audit ingestor and an audit dispatcher. The audit server is not yet part of a release. -
For a real deployment, follow Deployment and configuration and then walk through the first policy tutorial.
- If you are integrating an application, read the architecture overview and the plugin architecture pages first.
Further reading¶
- Source:
security-adminandembeddedwebservermodules - Ranger UserSync, Ranger TagSync, Ranger KMS
- Audit framework