Connector instances, policy repository instances, and datasource instances can be configured in various topologies.

Required basic PolicySync topology

The default, basic, required topology is a single connector instance, a single policy repository, a single third-party system datasource.

Creating this basic topology is detailed in Required basic PolicySync topology: always at least one connector instance.

PolicySync topology: multiple connectors and datasources, single policy repository

An alternative to the basic topology is a single Privacera policy repository with multiple Privacera connector instances to distribute the same policies to several different datasources.

Creating this configuration is detailed in Optional topology: multiple connector instances for Kubernetes pods and Docker containers.

PolicySync topology: unique connectors, datasources, and policy repositories

The optimal topology is one connector instance with one policy repository instance for a single datasource instance.

For distinct access management policies for distinct organizational groups that require distinct access rights, Privacera recommends the PolicySync topology of a separate, unique policy repository for each connector instance and its associated datasource instance.

Creating this configuration is detailed in Recommended PolicySync topology: individual policy repositories for individual connectors

PolicySync works with configured connector instances for each instance of the third-party system datasource you want to manage.

You configure connectors in the following directories in Privacera Manager, with a YAML properties file for each instance of the connector:

~/privacera/privacera-manager/config/custom-vars/connectors/<ConnectorName>/<someInstanceName>/vars.connector.<ConnectorName>.yml

where the following sections define this syntax.

For each third-party system datasource, you must always create at least one PolicySync connector instance with the directory structure and file naming described in Connector instance directory/file structure.

For example, suppose you have a single instance of PostgreSQL in production. Let's call this instance postgres-prod-instance.

Follow these steps to create the PolicySync configuration for it.

cd ~/privacera/privacera-manager
#
# Make the connector subdirectory 
# for the PostgreSQL production instance
# called postgres-prod-instance
mkdir -p config/custom-vars/connectors/postgres/postgres-prod-instance
#
# Copy the template PostgreSQL connector properties .yml file 
# to the postgres-prod-instance subdirectory
# for the production instance
cp config/sample-vars/vars.connector.postgres.yml \
config/custom-vars/connectors/postgres/postgres-prod-instance
#
# Set the values of the properties in the YAML file
# called vars.connector.postgres.yml
# for this example postgres-prod-instance instance
#
# Properties are defined in the documentation 
# for each of the individual third-party systems.
#
vi config/custom-vars/connectors/postgres/postgres-prod-instance/vars.connector.postgres.yml
#
# Save the file
#
# Update the running configuration
./privacera-manager.sh update

Suppose you have three different Kubernetes pods for three different instances of PostgreSQL databases. Let's name the subdirectories for these instances as follows:

For each connector instance, create the directory/file structure following the details in Required basic PolicySync topology: always at least one connector instance and define the PolicySync properties for each instance in its vars.connector.<ConnectorName>.yml YAML file.

You will have a directory structure like this:

cd ~/privacera/privacera-manager
ls -R config/custom-vars/connectors

config/custom-vars/connectors/postgres:
postgres-dev-instance	postgres-prod-instance	postgres-qa-instance

config/custom-vars/connectors/postgres/postgres-dev-instance:
vars.connector.postgres.yml

config/custom-vars/connectors/postgres/postgres-prod-instance:
vars.connector.postgres.yml

config/custom-vars/connectors/postgres/postgres-qa-instance:
vars.connector.postgres.yml

By default, when you configure multiple connectors, policies are stored in the connector's default single PolicySync policy repository. But you can define an individual policy repository for each individual connector instance and datasource instance.

For distinct access management policies for distinct organizational groups that require distinct access rights, Privacera recommends the PolicySync topology of a separate, unique policy repository for each connector instance and its associated datasource instance.

When you configure a connector's first instance, the following properties for the policy repository are added to your connector instance's YAML file, in this example, ~/privacera/privacera-manager/config/custom-vars/connectors/postgres/postgres-prod-instance/vars.connector.postgres.yml.

Any new connector instances share that same single, common policy repository. The example below shows this shared repository: privacera_postgres.

ranger.policysync.connector.0.ranger.service.name=privacera_postgres
ranger.policysync.connector.0.ranger.service.appid=privacera_postgres

Setting up individual repositories per connector is a two-step process:

Create policy repository for each connector instance in Privacera Access Management

In this example, create the privacera_postgres_prod_instance. policy repository.

1. As administrator, go to Access Management > Resource Policies.

2. Locate the third-party connector already available. In this example, the single shared repository for PostgreSQL is shown:

3. From the three vertical dots on the upper right, select Add Service:

4. Enter the Service Name. Follow your naming convention described in 2. In this example, privacera_postgres_prod_instance.

5. Under Select Tag Service, choose privacera_tag.

6. Click SAVE.

   The new repository has been created.

7. Repeat these steps for as many other policy repositories you want.

In this example, the three separate repositories are ready:

~/privacera/privacera-manager/config/custom-vars/connectors/<ConnectorName>/custom/connector-custom.properties

To protect sensitive values in your YAML files, PolicySync can encrypt them.

To encrypt property values, create the following file and specify the property names whose values to encrypt:

~/privacera/privacera-manager/config/custom-vars/vars.encrypt.secrets.yml

CONNECTOR_ENCRYPT_PROPS_LIST:
  - <PROPERTY_NAME1>
  - <PROPERTY_NAME2>
  - <PROPERTY_NAME3>

where:

Example: In the following example, the file ~/privacera/privacera-manager/config/custom-vars/vars.encrypt.secrets.yml specifies encryption of the PostgreSQL connector's property values of JDBC username, JDBC password, and JDBC database and the Google BigQuery connector's property values of JDBC URL and organization ID:

CONNECTOR_ENCRYPT_PROPS_LIST:
  - CONNECTOR_POSTGRES_JDBC_USERNAME
  - CONNECTOR_POSTGRES_JDBC_PASSWORD
  - CONNECTOR_POSTGRES_JDBC_DB
  - CONNECTOR_BIGQUERY_JDBC_URL
  - CONNECTOR_BIGQUERY_ORGANIZATION_ID