Skip to main content

Privacera Documentation

Databricks SQL fields on PrivaceraCloud

Basic fields

Table 16. Basic fields

Field name

Type

Default

Required

Description

Databricks SQL jdbc url

string

Yes

Specifies the JDBC URL for the Databricks SQL connector.

Use the following format for the JDBC URL:

jdbc:spark://<WORKSPACE_URL>:443/<DATABASE>;transportMode=http;ssl=1;AuthMech=3;httpPath=/sql/1.0/endpoints/1234567890

The workspace URL and the database name are derived from your Databricks SQL configuration.

Databricks SQL jdbc username

string

Yes

Specifies the JDBC username to use.

Databricks SQL jdbc password

string

Yes

Specifies the access token of the SQL endpoint to use.

Databricks SQL default database

string

Yes

Specifies the name of the JDBC database to use.

Databricks SQL resource owner

string

No

Specifies the role that owns the resources managed by PolicySync. You must ensure that this user exists as PolicySync does not create this user.

  • If a value is not specified, resources are owned by the creating user. In this case, the owner of the resource will have all access to the resource.

  • If a value is specified, the owner of the resource will be changed to the specified value.

The following resource types are supported:

  • Database

  • Schemas

  • Tables

  • Views

Databricks SQL workspace URL

string

Yes

Specifies the base URL for the Databricks SQL instance.

Databases to set access control policies

string

No

Specifies a comma-separated list of database names for which PolicySync manages access control. If unset, access control is managed for all databases. If specified, use the following format. You can use wildcards. Names are case-sensitive.

An example list of databases might resemble the following: testdb1,testdb2,sales db*.

If specified, Databases to ignore while setting access control policies takes precedence over this setting.

Enable policy enforcements and user/group/role management

boolean

true

Yes

Specifies whether PolicySync performs grants and revokes for access control and creates, updates, and deletes queries for users, groups, and roles. The default value is true.

Enable access audits

boolean

true

Yes

Specifies whether Privacera fetches access audit data from the data source.



Advanced fields

Table 17. Advanced fields

Field name

Type

Default

Required

Description

Tables to set access control policies

string

No

Specifies a comma-separated list of table names for which PolicySync manages access control. You can use wildcards. Names are case-sensitive.

Use the following format when specifying a table:

<DATABASE_NAME>.<SCHEMA_NAME>.<TABLE_NAME>

If specified, Tables to ignore while setting access control policies takes precedence over this setting.

If you specify a wildcard, such as in the following example, all matched tables are managed:

<DATABASE_NAME>.<SCHEMA_NAME>.*

The specified value, if any, is interpreted in the following ways:

  • If unset, access control is managed for all tables.

  • If set to none no tables are managed.

Databases to ignore while setting access control policies

string

No

Specifies a comma-separated list of database names that PolicySync does not provide access control for. You can specify wildcards. Names are case-sensitive. If not specified, all databases are subject to access control.

For example:

testdb1,testdb2,sales_db*

This setting supersedes any values specified by Databases to set access control policies.

Tables to ignore while setting access control policies

string

No

Specifies a comma-separated list of table names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all tables are subject to access control. Names are case-sensitive. Specify tables using the following format:

<DATABASE_NAME>.<SCHEMA_NAME>.<TABLE_NAME

This setting supersedes any values specified by Tables to set access control policies.

Regex to find special characters in names

string

[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]

No

Specifies a regular expression to apply to a user name and replaces each matching character with the value specified by the **String to replace with the special characters found in names** setting.

If not specified, no find and replace operation is performed.

String to replace with the special characters found in names

string

_

No

Specifies a string to replace the characters matched by the regex specified by the **Regex to find special characters in names** setting.

If not specified, no find and replace operation is performed.

Regex to find special characters in user names

string

[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]

No

Specifies a regular expression to apply to a username and replaces each matching character with the value specified by the String to replace with the special characters found in user names setting.

If not specified, no find and replace operation is performed.

String to replace with the special characters found in user names

string

_

No

Specifies a string to replace the characters matched by the regex specified by the Regex to find special characters in user names setting.

If not specified, no find and replace operation is performed.

Regex to find special characters in group names

string

[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]

No

Specifies a regular expression to apply to a group and replaces each matching character with the value specified by the String to replace with the special characters found in group names setting.

If not specified, no find and replace operation is performed.

String to replace with the special characters found in group names

string

_

No

Specifies a string to replace the characters matched by the regex specified by the Regex to find special characters in group names setting.

If not specified, no find and replace operation is performed.

Regex to find special characters in role names

string

[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]

No

Specifies a regular expression to apply to a role name and replaces each matching character with the value specified by the String to replace with the special characters found in role names setting.

If not specified, no find and replace operation is performed.

String to replace with the special characters found in role names

string

_

No

Specifies a string to replace the characters matched by the regex specified by the Regex to find special characters in role names setting.

If not specified, no find and replace operation is performed.

Persist case sensitivity of user names

boolean

false

No

Specifies whether PolicySync converts user names to lowercase when creating local users. If set to true, case sensitivity is preserved.

Persist case sensitivity of group names

boolean

false

No

Specifies whether PolicySync converts group names to lowercase when creating local groups. If set to true, case sensitivity is preserved.

Persist case sensitivity of role names

boolean

false

No

Specifies whether PolicySync converts role names to lowercase when creating local roles. If set to true, case sensitivity is preserved.

Create users in Databricks SQL Endpoint by policysync

boolean

true

No

Specifies whether PolicySync creates local users for each user in Privacera.

Manage users from portal

boolean

true

No

Specifies whether PolicySync maintains user membership in roles in the Databricks SQL data source.

Manage groups from portal

boolean

true

No

Specifies whether PolicySync creates groups from Privacera in the Databricks SQL data source.

Manage roles from portal

boolean

true

No

Specifies whether PolicySync creates roles from Privacera in the Databricks SQL data source.

Users to set access control policies

string

No

Specifies a comma-separated list of user names for which PolicySync manages access control. You can use wildcards. Names are case-sensitive.

If not specified, PolicySync manages access control for all users.

If specified, Users to be ignored by access control policies takes precedence over this setting.

An example user list might resemble the following: user1,user2,dev_user*.

Groups to set access control policies

string

No

Specifies a comma-separated list of group names for which PolicySync manages access control. If unset, access control is managed for all groups. If specified, use the following format. You can use wildcards. Names are case-sensitive.

An example list of projects might resemble the following: group1,group2,dev_group*.

If specified, Groups be ignored by access control policies takes precedence over this setting.

Roles to set access control policies

string

No

Specifies a comma-separated list of role names for which PolicySync manages access control. If unset, access control is managed for all roles. If specified, use the following format. You can use wildcards. Names are case-sensitive.

An example list of projects might resemble the following: role1,role2,dev_role*.

If specified, Roles be ignored by access control policies takes precedence over this setting.

Users to be ignored by access control policies

string

No

Specifies a comma-separated list of user names that PolicySync does not provide access control for. You can specify wildcards. Names are case-sensitive. If not specified, all users are subject to access control.

This setting supersedes any values specified by Users to set access control policies.

Groups be ignored by access control policies

string

No

Specifies a comma-separated list of group names that PolicySync does not provide access control for. You can specify wildcards. Names are case-sensitive. If not specified, all groups are subject to access control.

This setting supersedes any values specified by Groups to set access control policies.

Roles be ignored by access control policies

string

No

Specifies a comma-separated list of role names that PolicySync does not provide access control for. You can specify wildcards. Names are case-sensitive. If not specified, all roles are subject to access control.

This setting supersedes any values specified by Roles to set access control policies.

Prefix of Databricks SQL Endpoint roles for portal groups

string

priv_group_

No

Specifies the prefix that PolicySync uses when creating local roles. For example, if you have a group named etl_users defined in Privacera and the role prefix is prefix_, the local role is named prefix_etl_users.

Prefix of Databricks SQL Endpoint roles for portal roles

string

priv_role_

No

Specifies the prefix that PolicySync uses when creating roles from Privacera in the Databricks SQL data source.

For example, if you have a role in Privacera named finance defined in Privacera and the role prefix is role_prefix_, the local role is named role_prefix_finance.

Use Databricks SQL Endpoint native public group for public group access policies

boolean

true

No

Specifies whether PolicySync uses the Databricks SQL native public group for access grants whenever a policy refers to a public group. The default value is true.

Set access control policies only on the users from managed groups

boolean

false

No

Specifies whether to manage only the users that are members of groups specified by Groups to set access control policies. The default value is false.

Set access control policies only on the users/groups from managed roles

boolean

false

No

Specifies whether to manage only users that are members of the roles specified by Roles to set access control policies. The default value is false.

Use email as service name

boolean

true

No

This Property is used to map the username to the email address when granting/revoking access.

Enforce masking policies using secure views

boolean

true

No

Specifies whether to use secure view based masking. The default value is true.

Enforce row filter policies using secure views

boolean

true

No

Specifies whether to use secure view based row filtering. The default value is true.

While Databricks SQL supports native filtering, PolicySync provides additional functionality that is not available natively. Enabling this setting is recommended.

Create secure view for all tables/views

boolean

true

No

Specifies whether to create secure views for all tables and views that are created by users. If enabled, PolicySync creates secure views for resources regardless of whether masking or filtering policies are enabled.

Default masked value for numeric datatype columns

integer

0

No

Specifies the default masking value for numeric column types.

Default masked value for text/varchar/string datatype columns

string

<MASKED>

No

Specifies the default masking value for text and string column types.

Secure view name prefix

string

No

Specifies a prefix string for secure views. By default view-based row filter and masking-related secure views have the same schema name as the table schema name.

If you want to change the secure view schema name prefix, specify a value for this setting. For example, if the prefix is dev_, then the secure view name for a table named example1 is dev_example1.

Secure view name postfix

string

No

Specifies a postfix string for secure views. By default view-based row filter and masking-related secure views have the same schema name as the table schema name.

If you want to change the secure view schema name postfix, specify a value for this setting. For example, if the postfix is _dev, then the secure view name for a table named example1 is example1_dev.

Secure view database name prefix

string

No

Specifies a prefix string for secure views. By default view-based row filter and masking-related secure views have the same name as the table database name.

For example, if the prefix is priv_, then the secure view name for a database named example1 is priv_example1.

Secure view database name postfix

string

_secure

No

Specifies a postfix string for secure views. By default view-based row filter and masking-related secure views have the same name as the table database name.

For example, if the postfix is _sec, then the secure view name for a database named example1 is example1_sec.

Enable dataadmin

boolean

true

No

This property is used to enable the data admin feature. With this feature enabled you can create all the policies on native tables/views, and respective grants will be made on the secure views of those native tables/views. These secure views will have row filter and masking capability. In case you need to grant permission on the native tables/views then you can select the permission you want plus data admin in the policy. Then those permissions will be granted on both the native table/view as well as its secure view.

Users to exclude when fetching access audits

string

{{DATABRICKS_SQL_ANALYTICS_JDBC_USERNAME}}

No

Specifies a comma separated list of users to exclude when fetching access audits. For example: "user1,user2,user3".



Custom fields

Table 18. Custom fields

Canonical name

Type

Default

Description

load.resources

string

load_like

Specifies how PolicySync loads resources from Databricks SQL. The following values are allowed:

  • load_like: Default value for loading resources, to be used in production.

  • load: Load resources from Databricks SQL with a top-down resources approach, that is, it first loads the database and then the schemas followed by tables and its columns. This mode is only for development purposes.

sync.interval.sec

integer

60

Specifies the interval in seconds for PolicySync to wait before checking for new resources or changes to existing resources.

sync.serviceuser.interval.sec

integer

420

Specifies the interval in seconds for PolicySync to wait before reconciling principals with those in the data source, such as users, groups, and roles. When differences are detected, PolicySync updates the principals in the data source accordingly.

sync.servicepolicy.interval.sec

integer

540

Specifies the interval in seconds for PolicySync to wait before reconciling Apache Ranger access control policies with those in the data source. When differences are detected, PolicySync updates the access control permissions on data source accordingly.

audit.interval.sec

integer

30

Specifies the interval in seconds to elapse before PolicySync retrieves access audits and saves the data in Privacera.

user.name.case.conversion

string

lower

Specifies how user name conversions are performed. The following options are valid:

  • lower: Convert to lowercase

  • upper: Convert to uppercase

  • none: Preserve case

This setting applies only if Persist case sensitivity of user names is set to true.

group.name.case.conversion

string

lower

Specifies how group name conversions are performed. The following options are valid:

  • lower: Convert to lowercase

  • upper: Convert to uppercase

  • none: Preserve case

This setting applies only if Persist case sensitivity of group names is set to true.

role.name.case.conversion

string

lower

Specifies how role name conversions are performed. The following options are valid:

  • lower: Convert to lowercase

  • upper: Convert to uppercase

  • none: Preserve case

This setting applies only if Persist case sensitivity of role names is set to true.

secure.view.name.remove.suffix.list

string

Specifies a suffix to remove from a table or view name. For example, if the table is named example_suffix you can remove the _suffix string. This transformation is applied before any custom prefix or postfix is applied.

You can specify a single suffix or a comma separated list of suffixes.

secure.view.database.name.remove.suffix.list

string

Specifies a suffix to remove from a database name. For example, if the database is named example_suffix you can remove the _suffix string. This transformation is applied before any custom prefix or postfix is applied.

You can specify a single suffix or a comma separated list of suffixes.

audit.init.starttime.offset.minutes

integer

30

Specifies the initial delay, in minutes, before PolicySync retrieves access audits from Databricks SQL.