Skip to content

Ranger Admin

Ranger Admin is the central service of Apache Ranger. It is the place where security administrators define who may do what on which data, and where auditors go to see what actually happened. Everything else in Ranger either feeds Admin (UserSync, TagSync) or takes instructions from it: the plugins that run inside protected services such as Apache Polaris, Trino, Ozone, Kafka, Hive and HDFS, and the PDP server that answers authorization requests for any other application.

Admin is a single Java web application. It embeds its own Tomcat server, exposes a React-based web UI and a REST API, and keeps all of its state in a relational database. Plugins never talk to the database; they download policies from Admin over HTTP(S) and keep a local copy, so a temporary Admin outage does not stop authorization in the protected services.

What Ranger Admin does

Policy administration
Create and manage service definitions, services, resource-based and tag-based policies, row-filter and masking policies, security zones and Governed Data Sharing objects.
Policy distribution
Serves versioned policy, tag, role and user-store downloads to plugins (/service/plugins/policies/download/..., /service/tags/download/..., /service/roles/download/...).
Identity store
Holds portal users and their roles, plus the users and groups synced by UserSync and referenced in policies.
Audit viewer
Queries the configured audit store (Solr, Elasticsearch, OpenSearch or CloudWatch) and shows access audits, admin changes, login sessions, plugin downloads and plugin status.
Key administration
Hosts the Key Manager UI for Ranger KMS (users with the KeyAdmin role).
Operational surface
Health endpoints, Prometheus and JSON metrics, REST API for automation.

How it works

flowchart LR
  UI[Web UI / REST clients] -->|HTTPS 6182 / HTTP 6080| ADMIN[Ranger Admin]
  US[UserSync] -->|users and groups| ADMIN
  TS[TagSync] -->|tags| ADMIN
  ADMIN -->|JDBC| DB[(Policy database)]
  ADMIN -->|queries| AUD[(Audit store)]
  P1[Plugin in Trino] -->|poll policies, tags, roles| ADMIN
  P2[Plugin in HiveServer2] -->|poll policies, tags, roles| ADMIN
  P1 -->|audit events| AUD
  P2 -->|audit events| AUD

Inside the process:

  • Embedded web server (embeddedwebserver module, org.apache.ranger.server.tomcat.EmbeddedServer) starts Tomcat, opens the HTTP/HTTPS connectors and, on start-up, bootstraps the Solr collection, Elasticsearch or OpenSearch index used for audits.
  • Spring Security filter chain (security-applicationContext.xml) authenticates requests using the configured method: local database, PAM, LDAP, Active Directory, Kerberos/SPNEGO, Knox SSO, JWT bearer tokens or trusted headers. See Authentication.
  • REST layer (org.apache.ranger.rest.*) implements the API under /service/...; the UI is only a client of that API. See the REST API overview.
  • Persistence uses JPA (EclipseLink) over MySQL, PostgreSQL, Oracle, SQL Server or SQL Anywhere. Schema creation and upgrades are handled by numbered SQL and Java patches. See Database.
  • Metrics are exported through the ranger-metrics module in Prometheus and JSON formats. See Metrics.

Default ports

Port Property Purpose
6080 ranger.service.http.port HTTP UI and REST API
6182 ranger.service.https.port HTTPS UI and REST API, replaces the HTTP port when ranger.service.https.attrib.ssl.enabled=true
6085 ranger.service.shutdown.port Tomcat shutdown port, local use only

Default accounts

The database schema creates four portal users. In the dev-support/ranger-docker setup their passwords are set from the RANGER_*_PASSWORD variables in .env when the database is first prepared; all default to rangerR0cks!. Change the passwords before the deployment is exposed to users; see Security hardening.

Login Role Used by
admin Admin Human administrators, first login
rangerusersync Admin UserSync when it pushes users and groups
rangertagsync Admin TagSync when it pushes tags
keyadmin KeyAdmin Ranger KMS key administration

Pages in this section

  • Deployment and configuration: running Admin with Docker and ranger-admin-services.sh, ranger-admin-site.xml reference, logs, upgrade
  • Authentication: every login method for the UI and REST API, with the properties that control each
  • Users, groups and roles: internal and external users, admin roles, read-only auditors, permissions module, deleting users
  • Database: supported databases, schema and patch mechanism, connection pool, SSL to the database, backup and restore
  • High availability: running several Admin instances behind a load balancer and how plugins cope with outages
  • Security hardening: lock-down checklist, HTTPS, plugin-to-Admin SSL, credential store, CSRF and password policy
  • Admin UI guide: a tour of Service Manager, policies, audits, settings, zones, reports and Governed Data Sharing
  • Metrics: Prometheus and JSON metrics, JVM and container metrics, audit metrics, CLI metric collection

Where to start

  • To try Ranger quickly, run it with Docker. Both ways are described step by step in Run with Docker:

    Released images apache/ranger, apache/ranger-db and apache/ranger-solr (tags up to 2.9.0): Ranger Admin with a PostgreSQL database and a standalone Solr audit store.

    Images built from the source tree with docker-compose.ranger.yml and docker-compose.ranger-audit-service.yml: Ranger Admin, the database selected with RANGER_DB_TYPE, Kafka, OpenSearch, the audit ingestor and an audit dispatcher. The audit server is not yet part of a release.

  • For a real deployment, follow Deployment and configuration and then walk through the first policy tutorial.

  • If you are integrating an application, read the architecture overview and the plugin architecture pages first.

Further reading