Release 9.2.48.1¶

Faster Role, User and Group Updates¶

Adding members to large roles and removing them is now much faster. Updating a user's details or renaming a user or group no longer slows down when the user or group belongs to many roles. Saves that wouldn't change a role are now skipped, and adding a member whose name differs only in case no longer creates a duplicate.

Authorization Fix For Trusted-Proxy (doAs) Requests¶

Updated Ranger Admin to authorize doAs requests using the target user's roles instead of the proxy account's roles, preventing privilege escalation. Requests with unauthorized users or duplicate doAs parameters are rejected with HTTP 403. The 403 response format remains unchanged.

Apache Ranger Base Image Upgrade¶

Updated the base image to a newer version to remediate security vulnerabilities identified in the CVE report.

Audit Fluentd Base Image Upgraded¶

Updated the Audit Fluentd base image to a newer Debian version to address known security vulnerabilities identified in the Common Vulnerabilities and Exposures (CVE) report.

Updated Fluentd Dependencies¶

Upgraded Fluentd dependencies to address known security vulnerabilities identified in the CVE report.

Audit Server Base Image Upgrade¶

Updated the base image to a newer version to remediate security vulnerabilities identified in the CVE report.

Boto3 Signer - Fixed Bulk Delete and Session-Based S3 Clients¶

Fixed bulk delete_objects calls do not delete their objects: the keys are sent in the request body, so access was evaluated against the bucket alone; every key is now authorized and audited individually, and keys the user is not allowed to delete are left in place. Fixed S3 clients created through boto3.Session() bypass the signer, leaving their requests neither access-controlled nor audited; client and resource creation is now signed on every path.

Updated DataServer Dependencies¶

Upgraded DataServer dependencies to address known security vulnerabilities identified in the CVE (Common Vulnerabilities and Exposures) report.

DataServer Base Image Upgraded¶

Updated the DataServer base image to a newer Debian version to address known security vulnerabilities identified in the CVE report.

Added OLAC Support for EMR 7.13 and 7.14¶

• This release adds OLAC support for EMR 7.13 and 7.14.
• For the supported version matrix, refer to Supported Runtime Versions.

Added Support for Starburst Enterprise Version 482-e LTS¶

• This release adds support for Starburst Enterprise version 482-e LTS.
• For the supported version matrix, refer to Supported Runtime Versions.

Response Codes in Audits, Policy-Apply Latency, and Template UDF Update Audits¶

• PolicySync audits now list each outcome with a numbered response code.
• POLICY_RESPONSE audits include the policy's create and update time.
• Connectors report how long policies take to apply.
• Each Databricks Unity Catalog template update sends one summary audit, and each table's audit names the template version.

For more details, refer to Policy Tracing: Response codes.

Loader Run Times and Failed Loads in LOADER Audits¶

• LOADER audits now include the run's start and end time (in UTC), so one event shows when a load ran and how long it took.
• A failed load is now always reported, along with the next run after a failure and the first run after a restart.
• The permission loader can also send a STARTED audit for full loads.

LOADER audits are sent only when loader completion reporting is enabled, which is off by default.

For more details, refer to Policy Tracing: LOADER.

Policy Changes Saved During a UDF or Template Update Are Now Applied¶

Fixed an issue where a Ranger policy saved while an earlier change was still being applied could be missed and stay unapplied until the connector restarted. For a row-level filter policy, that meant users could briefly see unfiltered rows. These changes are now always applied.

Installs that use Ranger portal tags with tag-based masking keep the earlier behavior.

Ranger Principal Sync Continues When One Principal Fails¶

Fixed an issue where a single failing user, group or role stopped the whole principal sync, so remaining changes (including removals) were not applied and, on a first sync, other loaders did not start.

• The principal that fails is skipped and retried on the next sync, and the rest are applied.
• The principal-sync audit reports how many changes applied and how many failed.
• If the service keeps failing, the connector backs off and retries on the next sync.

Improved Handling of Sensitive Values in Logs¶

Improved how the connector handles sensitive values in its logs. Credentials and other sensitive values are now masked or omitted.

More Reliable Connector Restarts¶

The connector is now safer to restart: it no longer clears an internal lock at startup, which could previously let a second connector process open the same state while the first was still running.

On shared or network storage, after a node failure the connector may restart a few times until the previous lock is released.

First Scheduled Tag Sync No Longer Delayed After a Restart¶

Fixed an issue where, after a restart, the first scheduled full tag sync could be delayed by up to the tag sync interval. It now runs on its normal schedule.

Clearer Startup Error When CONNECTOR_HOME Is Not Set¶

The connector now stops at startup with a clear error when the CONNECTOR_HOME environment variable is not set, instead of using an unintended location for its dynamic configuration. The shipped image and start script set it, so standard deployments are not affected.

Databricks Unity Catalog: Option to Stop Full Loads Recreating Foreign Tables¶

Full (scheduled) resource loads treated foreign tables as dropped and recreated when only their created time changed, and re-applied all of their permissions. A new property stops this; by default, the existing behavior is kept.

For more details, refer to Foreign Table Recreate Detection in Scheduled Syncs.

Databricks Unity Catalog: Fixed Unnecessary Updates on Foreign Tables¶

Fixed an issue where unchanged foreign tables could be reported as updated across scheduled and on-demand loads.

Databricks Unity Catalog: Optional Resource Delta Log¶

Added an optional resource-delta.log. It records each resource that a resource load adds, recreates, updates or deletes, and the reason. It is off by default.

For more details, refer to Resource Sync Change Log.

Databricks Unity Catalog: Tunable Grant Statement Concurrency¶

• Parallel GRANT / REVOKE statements can now be sized per sync queue (on-demand, offline and the dedicated fast queue).
• The number of resource-processing threads can also be sized per queue.
• An opt-in mode caps each queue’s concurrent statements at its helper-thread count.
• Defaults are unchanged.

For more details, refer to Parallel Grant Statements.

Databricks Unity Catalog: Upgraded JDBC Driver¶

Upgraded the bundled Databricks JDBC driver from 3.4.2 to 3.4.4.

MSSQL: One Missing User No Longer Blocks UNMASK for Everyone¶

Fixed an issue where an UNMASK policy failed for all users and groups when one of them did not exist in the database, and the same change was sent again on every sync. The connector now skips only the missing users or groups, gives UNMASK to the rest, and names the skipped ones in the audit.

MSSQL: Offline or Deleted Databases No Longer Stop the Connector¶

Fixed an issue where one offline or deleted database in the managed database list made the connector retry it forever, which stopped syncing for all databases. When CONNECTOR_MSSQL_USE_MULT_DB_CONNECTION is "true", the connector now skips that database, keeps syncing the others, and checks it again every 10 minutes. Nothing is removed while it is down, and syncing resumes on its own when it is back.

We recommend turning on parallel resource loading (CONNECTOR_MSSQL_LOAD_RESOURCES_MULTITHREADED_ENABLED: "true"), so an offline database does not stop new tables in other databases from syncing.

MSSQL: Tables Now Load When the Database Name Differs Only in Case¶

Fixed an issue where schemas loaded but tables did not when a database name in the managed database list differed from the name in SQL Server only in upper or lower case, for example Reports and REPORTS.

Snowflake: Role Evaluation Mode for Masking and Row-Level Filter Policies¶

The Snowflake connector has a new property, CONNECTOR_SNOWFLAKE_ROLE_EVALUATION_MODE (ranger.policysync.connector.0.role.evaluation.mode). It sets how roles are checked in masking and row-level filter (RLF) policies:

• AVAILABLE_ROLES (default): CURRENT_AVAILABLE_ROLES()
• ROLE_IN_SESSION: IS_ROLE_IN_SESSION()
• CURRENT_ROLE (new): CURRENT_ROLE(). A role's policy applies only while that role is the user's primary role, set with USE ROLE. Requires use.current.user.for.row.filter.and.masking.policy=true.

The default keeps existing behavior. With CURRENT_ROLE, users must run USE ROLE with the PolicySync-managed role (for example priv_role_<role>) for the policy to apply. After changing the mode, disable and re-enable the affected policies so existing Snowflake policies are rewritten. This property replaces CONNECTOR_SNOWFLAKE_USE_CURRENT_AVAILABLE_ROLES (see Breaking Changes).

For more details, refer to Configure Role Evaluation Method for Masking and RLF.

Policy Apply SLA Row in the Connector-Common Dashboard¶

The Connector-Common Grafana dashboard has a new Policy Apply SLA row, collapsed by default. It shows:

• The p95 and p99 time from a policy's save in Ranger to the connector applying it.
• The share of changed policies applied within 1 minute, over a rolling hour and over the selected time range.
• The changed policies by outcome: COMPLETED, GRANT_PARTIALLY_APPLIED and FAILED.

Only fully applied changes count as applied within the SLA.