JDBC configuration properties

BASIC

CONNECTOR_DATABRICKS_SQL_ANALYTICS_JDBC_URL

This property is used to set jdbc jdbc url which can be used to connect to databricks sql endpoint. JDBC URL should follow below convention jdbc:spark://<WORKSPACE_URL>:443/<DATABASE>;transportMode=http;ssl=1;AuthMech=3;httpPath=/sql/1.0/endpoints/1234567890 Example :- jdbc:spark://example.cloud.databricks.com:443/default;transportMode=http;ssl=1;AuthMech=3;httpPath=/sql/1.0/endpoints/1234567890

BASIC

CONNECTOR_DATABRICKS_SQL_ANALYTICS_JDBC_USERNAME

This property is used to set jdbc Username to be used to make connection to databricks sql endpoint. This is just an email used to log in to Databricks to manage the SQL endpoint. (ex. eric.yuan@privacera.com)

BASIC

CONNECTOR_DATABRICKS_SQL_ANALYTICS_JDBC_PASSWORD

This is a personal access token used to access the databricks sql endpoint, that is created in Databricks by going to SQL endpoints and then "Create a personal access token". It should look like this: dapi71f8493d87bce9847d09e17a10ba8d53

BASIC

CONNECTOR_DATABRICKS_SQL_ANALYTICS_JDBC_DB

This property is used to set jdbc database to be used to make initial connection to databricks sql endpoint.

BASIC

CONNECTOR_DATABRICKS_SQL_ANALYTICS_OWNER_ROLE

This property is used to set ownership for all the resources managed by policysync. The specified user will become owner for all managed resources and will have full control on those resources.We support changing owners of database, tables and views. Note :- If owner role is kept as blank, then ownership will not change and users who creates tables/views or any other object will be the owner of those objects and policysync won't be able to do access control on that object

BASIC

CONNECTOR_DATABRICKS_SQL_ANALYTICS_HOST_URL

This property is used to make a call to SQL analytics API for users/groups/audits. It should simply be the base url of Databricks, for example https://db1.cloud.databricks.com/

BASIC

CONNECTOR_DATABRICKS_SQL_ANALYTICS_DEFAULT_USER_PASSWORD

This property is used to set password which will be used for every new user creation by policysync.

Resources management

BASIC

CONNECTOR_DATABRICKS_SQL_ANALYTICS_MANAGE_DATABASE_LIST

This property is used to set comma separated database names which access control should be managed by policysync. If you want to manage all databases then you can skip specifying this property. This supports wildcards as well. The ignore database list has precedence over manage database list. Eg. testdb1,testdb2,sales_db* **NOTE: values for this property are case-sensitive.

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_MANAGE_TABLE_LIST

This property is used to set comma separated table/view Fqdn which access control should be managed by policysync. If you want to manage all tables/views then you can skip specifying this property. This supports wildcards as well. The ignore table list has precedence over manage table list. Eg. testdb1.schema1.table1,testdb2.schema2.view2,sales_db*.sales*.* **NOTE: values for this property are case-sensitive.

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_IGNORE_DATABASE_LIST

This property is used to set comma separated database names which access control you don't want to be managed by policysync. If you don't want to ignore any database then you can skip specifying this property. This supports wildcards as well. This has precedence over manage database list. Eg. testdb1,testdb2,sales_db* **NOTE: values for this property are case-sensitive.

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_IGNORE_TABLE_LIST

This property is used to set comma separated table/view Fqdn which access control you don't want to be managed by policysync. If you don't want to ignore any tables/views then you can skip specifying this property. This supports wildcards as well. This has precedence over manage table list. Eg. testdb1.schema1.table1,testdb2.schema2.view2,sales_db*.sales*.* **NOTE: values for this property are case-sensitive.

Users/Groups/Roles management

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_NAME_REPLACE_FROM_REGEX

This takes the regular expression as input and finds the matching characters in a user name and replaces them with the characters specified in property. If kept blank, no find and replace operation is performed.

[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_NAME_REPLACE_TO_STRING

The value specified in this property is used to replace the characters found by the regex specified user name regex property. If kept blank, no find and replace operation is performed.

_

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_USER_NAME_REPLACE_FROM_REGEX

This takes the regular expression as input and finds the matching characters in a user name and replaces them with the characters specified in property. If kept blank, no find and replace operation is performed.

[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_USER_NAME_REPLACE_TO_STRING

The value specified in this property is used to replace the characters found by the regex specified user name regex property. If kept blank, no find and replace operation is performed.

_

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_GROUP_NAME_REPLACE_FROM_REGEX

This takes the regular expression as input and finds the matching characters in a group name and replaces them with the characters specified in property. If kept blank, no find and replace operation is performed.

[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_GROUP_NAME_REPLACE_TO_STRING

The value specified in this property is used to replace the characters found by the regex specified group name regex property. If kept blank, no find and replace operation is performed.

_

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_ROLE_NAME_REPLACE_FROM_REGEX

This takes the regular expression as input and finds the matching characters in a role name and replaces them with the characters specified in property. If kept blank, no find and replace operation is performed.

[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_ROLE_NAME_REPLACE_TO_STRING

The value specified in this property is used to replace the characters found by the regex specified role name regex property. If kept blank, no find and replace operation is performed.

_

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_USER_NAME_PERSIST_CASE_SENSITIVITY

After loading user from Ranger API's all are converted into lowercase, but in some cases, you would need to have the users in the same case as they are in Ranger. When setting this value to true, it will maintain the case sensitivity of names as they are in Ranger.

false

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_GROUP_NAME_PERSIST_CASE_SENSITIVITY

After loading group from Ranger API's all are converted into lowercase, but in some cases, you would need to have the users in the same case as they are in Ranger. When setting this value to true, it will maintain the case sensitivity of names as they are in Ranger.

false

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_ROLE_NAME_PERSIST_CASE_SENSITIVITY

After loading role from Ranger API's all are converted into lowercase, but in some cases, you would need to have the users in the same case as they are in Ranger. When setting this value to true, it will maintain the case sensitivity of names as they are in Ranger.

false

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_CREATE_USER

This property controls whether we should create user in databricks sql endpoint for users fetched from ranger.

true

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_MANAGE_USERS

This property controls whether we should create role in databricks sql endpoint for users fetched from ranger.

true

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_DELETE_USERS

When this property is set to true, PolicySync will delete users in Databricks when they are deleted in Portal. The property is set to false by default, as deleting users in Databricks wipes out their access tokens and other info.

false

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_MANAGE_GROUPS

This property controls whether we should create role in databricks sql endpoint for groups fetched from ranger.

true

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_MANAGE_ROLES

This property controls whether we should create role in databricks sql endpoint for roles fetched from ranger.

true

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_MANAGE_USER_LIST

This property is used to set comma separated user names which access control should be managed by policysync. If you want to manage all users then you can skip specifying this property. This supports wildcards as well. The ignore users list has precedence over manage users list. Eg. user1,user2,dev_user*

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_MANAGE_GROUP_LIST

This property is used to set comma separated group names which access control should be managed by policysync. If you want to manage all group then you can skip specifying this property. This supports wildcards as well. The ignore group list has precedence over manage group list. Eg. group1,group2,dev_group*

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_MANAGE_ROLE_LIST

This property is used to set comma separated role names which access control should be managed by policysync. If you want to manage all role then you can skip specifying this property. This supports wildcards as well. The ignore role list has precedence over manage role list. Eg. role1,role2,dev_role*

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_IGNORE_USER_LIST

This property is used to set comma separated user names which access control you don't want to be managed by policysync. If you don't want to ignore any users then you can skip specifying this property. This supports wildcards as well. This has precedence over manage users list. Eg. user1,user2,dev_user*

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_IGNORE_GROUP_LIST

This property is used to set comma separated group names which access control you don't want to be managed by policysync. If you don't want to ignore any groups then you can skip specifying this property. This supports wildcards as well. This has precedence over manage groups list. Eg. group1,group2,dev_group*

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_IGNORE_ROLE_LIST

This property is used to set comma separated role names which access control you don't want to be managed by policysync. If you don't want to ignore any roles then you can skip specifying this property. This supports wildcards as well. This has precedence over manage roles list. Eg. role1,role2,dev_role*

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_GROUP_ROLE_PREFIX

This property is used to set a prefix for role which we will be creating in databricks sql endpoint for group from ranger. For example if you have group named dev in ranger and you have defined prefix as test_group_ then the role which we create for dev in databricks sql endpoint will have name test_group_dev. NOTE: This property does not exist for users because users are using emails instead of usernames to log in.

priv_group_

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_ROLE_ROLE_PREFIX

This property is used to set a prefix for role which we will be creating in databricks sql endpoint for role from ranger. For example if you have role named finance in ranger and you have defined prefix as test_role_ then the role which we create for finance in databricks sql endpoint will have name test_role_finance. NOTE: This property does not exist for users because users are using emails instead of usernames to log in.

priv_role_

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_USE_NATIVE_PUBLIC_GROUP

Set this property to true, if you want PolicySync to use the "public" group in databricks for access grants whenever there is policy created referring to public group inside it.

true

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_MANAGE_USER_FILTERBY_GROUP

Set this property to true, if you want to manage only the users who belongs to the groups defined in manage groups list property.

false

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_MANAGE_USER_FILTERBY_ROLE

Set this property to true, if you want to manage only the users who belongs to the roles defined in manage roles list property.

false

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_USER_USE_EMAIL_AS_SERVICE_NAME

This Property is used to map the username as email address while grant/revoke

true

Access control management

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_ENABLE_VIEW_BASED_MASKING

Set this property to true, if you want to enable secure view based masking in databricks policysync. Note :- Databricks does not support native masking, so it is recommended to use view based masking.

true

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_ENABLE_VIEW_BASED_ROW_FILTER

Set this property to true, if you want to enable secure view based tr filter in databricks policysync. Note :- Databricks does not support native tr filters,so it is recommended to use view based tr filters.

true

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_SECURE_VIEW_CREATE_FOR_ALL

Set this property to true, if you want to create secure view for all tables as well all view which were created by end users. This will create secure view for resource regardless whether there any masking/tr filter policy exists in ranger.

true

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_MASKED_NUMBER_VALUE

This property is used to specify the default masking value for numeric columns

0

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_MASKED_TEXT_VALUE

This property is used to specify the default masking value for text/string columns

<MASKED>'

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_SECURE_VIEW_NAME_PREFIX

By default view-based tr filter and masking related secure views have the same name as the table name with postfixed by _secure. If you want to change the secure view name prefix and postfix, that can be done with these properties. After prefix and postfix is specified the view name will be in this format : {prefix}{table_name}{postfix}

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_SECURE_VIEW_NAME_POSTFIX

By default view-based tr filter and masking related secure views have the same name as the table name with postfixed by _secure. If you want to change the secure view name prefix and postfix, that can be done with these properties. After prefix and postfix is specified the view name will be in this format : {prefix}{table_name}{postfix}

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_SECURE_VIEW_DATABASE_NAME_PREFIX

By default view-based tr filter and masking related secure views have the same schema name as the table database name. If you want to change the secure view database name prefix and postfix, that can be done with these properties. After prefix and postfix is specified the view database name will be in this format : {prefix}{view_database_name}{postfix}

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_SECURE_VIEW_DATABASE_NAME_POSTFIX

By default view-based tr filter and masking related secure views have the same database name as the table database name. If you want to change the secure view database name prefix and postfix, that can be done with these properties. After prefix and postfix is specified the view database name will be in this format : {prefix}{view_database_name}{postfix}

_secure

BASIC

CONNECTOR_DATABRICKS_SQL_ANALYTICS_GRANT_UPDATES

This property controls whether actual grant/revoke and create/update/delete queries for user/group/role should be run on databricks sql endpoint.

true

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_ENABLE_DATA_ADMIN

This property is used to enable data admin feature, with data admin feature enabled you can create all the policies on table/native view and by default respective grants will be made on secure view of table table or native view. And this secure view will have tr filter and masking capability as well. In case if you need permission on table then you can select the permission you want plus dataadmin in the policy, In this case that permissions will be granted on both, the table/native view and its secure view as well

true

Access audits management

BASIC

CONNECTOR_DATABRICKS_SQL_ANALYTICS_AUDIT_ENABLE

This property is used to enable access audit fetching from databricks sql endpoint

true

ADVANCED

CONNECTOR_DATABRICKS_SQL_ANALYTICS_AUDIT_EXCLUDED_USERS

This property is used to exclude the users while pushing the audits logs to ranger access audits. Recommended to set this as JDBC user name as there will be audits from policysync application.

{{DATABRICKS_SQL_ANALYTICS_JDBC_USERNAME}}

JDBC configuration properties

BASIC

CONNECTOR_DREMIO_JDBC_URL

This property is used to set JDBC url which can be used to create a direct connection to a Dremio coordinator node. JDBC URL should follow below convention jdbc:dremio:direct=<DREMIO_COORDINATOR>:31010 Example :- jdbc:dremio:direct=example-12345fg.us-east-1.elb.amazonaws.com:31010

BASIC

CONNECTOR_DREMIO_JDBC_USERNAME

This property is used to set JDBC Username to be used to make connection to Dremio coordinator. This is just an username used to log in to Dremio to manage the Authorization. (ex. adminUser)

BASIC

CONNECTOR_DREMIO_JDBC_PASSWORD

This property is used to set JDBC user's password to be used to make connection to Dremio coordinator.

BASIC

CONNECTOR_DREMIO_OWNER_ROLE

This property is used to set ownership for all the resources managed by policysync. The specified user will become owner for all managed resources and will have full control on those resources. We support changing owners of source, space, source folders, space folders, physical datasets and virtual datasets. Note :- If owner role is kept as blank, then ownership will not change and users who creates resources or any other object will be the owner of those objects and policysync won't be able to do access control on that objects.

BASIC

CONNECTOR_DREMIO_URL

This property is used to make a call to Dremio API for catalogs/users/groups/audits. For example https://internal-dummy.us-east-1.elb.amazonaws.com:9047

BASIC

CONNECTOR_DREMIO_DEFAULT_USER_PASSWORD

This property is used to set password which will be used as default password for every new user created by policysync.

Resources management

BASIC

CONNECTOR_DREMIO_MANAGE_SPACE_LIST

This property is used to set comma separated space names for which access control should be managed by policysync. If you want to manage all spaces then you can skip specifying this property. This supports wildcards as well. The ignore space list has precedence over manage space list. Eg. testspace1,testspace2,space* Note :- values for this property are case-sensitive.

BASIC

CONNECTOR_DREMIO_MANAGE_SOURCE_LIST

This property is used to set comma separated source names which access control should be managed by policysync. If you want to manage all sources then you can skip specifying this property. This supports wildcards as well. The ignore source list has precedence over manage source list. Eg. testsource1,testsource2,source* Note :- values for this property are case-sensitive.

ADVANCED

CONNECTOR_DREMIO_MANAGE_SOURCE_FOLDER_LIST

This property is used to set comma separated source folder for which access control should be managed by policysync. If you want to manage all source folder then you can skip specifying this property. This supports wildcards as well. The ignore source folder list has precedence over manage source folder list. Eg. source.sourcefolder,source*.sales* Note :- values for this property are case-sensitive.

ADVANCED

CONNECTOR_DREMIO_MANAGE_SPACE_FOLDER_LIST

This property is used to set comma separated space folder for which access control should be managed by policysync. If you want to manage all space folders then you can skip specifying this property. This supports wildcards as well. The ignore space folder list has precedence over manage space folder list. Eg. space.spacefolder,space*.sales* Note :- values for this property are case-sensitive.

ADVANCED

CONNECTOR_DREMIO_MANAGE_PHYSICAL_DATASET_LIST

This property is used to set comma separated physical datasets for which access control should be managed by policysync. If you want to manage all physical datasets then you can skip specifying this property. This supports wildcards as well. The ignore physical dataset list has precedence over manage physical dataset list. Eg. source.folder1.physicaldataset,source*.sales*.* Note :- values for this property are case-sensitive.

ADVANCED

CONNECTOR_DREMIO_MANAGE_VIRTUAL_DATASET_LIST

This property is used to set comma separated virtual datasets for which access control should be managed by policysync. If you want to manage all virtual datasets then you can skip specifying this property. This supports wildcards as well. The ignore virtual dataset list has precedence over manage virtual dataset list. Eg. space.folder1.virtualdataset,space*.sales*.* Note :- values for this property are case-sensitive.

ADVANCED

CONNECTOR_DREMIO_IGNORE_SOURCE_LIST

This property is used to set comma separated source names for which you don't want access control to be managed by policysync. If you don't want to ignore any source then you can skip specifying this property. This supports wildcards as well. This has precedence over manage source list. Eg. testsource,sales* Note :- values for this property are case-sensitive.

ADVANCED

CONNECTOR_DREMIO_IGNORE_SPACE_LIST

This property is used to set comma separated space names for which you don't want access control to be managed by policysync. If you don't want to ignore any space then you can skip specifying this property. This supports wildcards as well. This has precedence over manage space list. Eg. testspace,sales* Note :- values for this property are case-sensitive.

ADVANCED

CONNECTOR_DREMIO_IGNORE_SOURCE_FOLDER_LIST

This property is used to set comma separated source folder names for which you don't want access control to be managed by policysync. If you don't want to ignore any source folder then you can skip specifying this property. This supports wildcards as well. This has precedence over manage source folder list. Eg. source.sourcefolder,source*.sales* Note :- values for this property are case-sensitive.

ADVANCED

CONNECTOR_DREMIO_IGNORE_SPACE_FOLDER_LIST

This property is used to set comma separated space folder names for which you don't want access control to be managed by policysync. If you don't want to ignore any space folder then you can skip specifying this property. This supports wildcards as well. This has precedence over manage space folder list. Eg. space.spacefolder,space*.sales* Note :- values for this property are case-sensitive.

ADVANCED

CONNECTOR_DREMIO_IGNORE_PHYSICAL_DATASET_LIST

This property is used to set comma separated physical dataset names for which you don't want access control to be managed by policysync. If you don't want to ignore any physical dataset then you can skip specifying this property. This supports wildcards as well. This has precedence over manage physical dataset list. Eg. source.folder1.physicaldataset,source*.sales*.* Note :- values for this property are case-sensitive.

ADVANCED

CONNECTOR_DREMIO_IGNORE_VIRTUAL_DATASET_LIST

This property is used to set comma separated virtual dataset names for which you don't want access control to be managed by policysync. If you don't want to ignore any virtual dataset then you can skip specifying this property. This supports wildcards as well. This has precedence over manage virtual dataset list. Eg. source.folder1.virtualdataset,source*.sales*.* Note :- values for this property are case-sensitive.

Users/Groups/Roles management

ADVANCED

CONNECTOR_DREMIO_USER_NAME_REPLACE_FROM_REGEX

This takes the regular expression as input and finds the matching characters in a user name and replaces them with the characters specified in property. If kept blank, no find and replace operation is performed.

[~`$&+:;=?@#|'<>.\\\\s^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]

ADVANCED

CONNECTOR_DREMIO_USER_NAME_REPLACE_TO_STRING

The value specified in this property is used to replace the characters found by the regex specified user name regex property. If kept blank, no find and replace operation is performed.

_

ADVANCED

CONNECTOR_DREMIO_GROUP_NAME_REPLACE_FROM_REGEX

This takes the regular expression as input and finds the matching characters in a group name and replaces them with the characters specified in property. If kept blank, no find and replace operation is performed.

[~`$&+:;=?@#|'<>.\\\\s^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]

ADVANCED

CONNECTOR_DREMIO_GROUP_NAME_REPLACE_TO_STRING

The value specified in this property is used to replace the characters found by the regex specified group name regex property. If kept blank, no find and replace operation is performed.

_

ADVANCED

CONNECTOR_DREMIO_ROLE_NAME_REPLACE_FROM_REGEX

This takes the regular expression as input and finds the matching characters in a role name and replaces them with the characters specified in property. If kept blank, no find and replace operation is performed.

[~`$&+:;=?@#|'<>.\\\\s^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]

ADVANCED

CONNECTOR_DREMIO_ROLE_NAME_REPLACE_TO_STRING

The value specified in this property is used to replace the characters found by the regex specified role name regex property. If kept blank, no find and replace operation is performed.

_

ADVANCED

CONNECTOR_DREMIO_USER_NAME_PERSIST_CASE_SENSITIVITY

After loading user from Ranger API's all users are converted into lowercase, but in some cases, you would need to have the users in the same case as they are in Ranger. When setting this value to true, it will maintain the case sensitivity of names as they are in Ranger.

false

ADVANCED

CONNECTOR_DREMIO_GROUP_NAME_PERSIST_CASE_SENSITIVITY

After loading group from Ranger API's all groups are converted into lowercase, but in some cases, you would need to have the groups in the same case as they are in Ranger. When setting this value to true, it will maintain the case sensitivity of names as they are in Ranger.

false

ADVANCED

CONNECTOR_DREMIO_ROLE_NAME_PERSIST_CASE_SENSITIVITY

After loading role from Ranger API's all roles are converted into lowercase, but in some cases, you would need to have the roles in the same case as they are in Ranger. When setting this value to true, it will maintain the case sensitivity of names as they are in Ranger.

false

CONNECTOR_DREMIO_USER_NAME_CASE_CONVERSION

This property only applicable if USER NAME PERSIST CASE SENSITIVITY is set to false. Managed users name would be treated as lowercase by default. If the value is set to "upper" then the user name would be treated as uppercase. If the value is set to "none" then the user name case is preserved as present in ranger.

lower

ADVANCED

CONNECTOR_DREMIO_CREATE_USER

This property controls whether we should create user in dremio for users fetched from ranger.

true

ADVANCED

CONNECTOR_DREMIO_CREATE_USER_ROLE

This property controls whether we should create role over the end user in dremio for users fetched from ranger.

true

ADVANCED

CONNECTOR_DREMIO_MANAGE_USERS

This property controls whether we should create role in dremio for users fetched from ranger.

true

ADVANCED

CONNECTOR_DREMIO_MANAGE_GROUPS

This property controls whether we should create role in dremio for groups fetched from ranger.

true

CUTSTOM

CONNECTOR_DREMIO_MANAGE_GROUP_MEMBERS

true

ADVANCED

CONNECTOR_DREMIO_MANAGE_ROLES

This property controls whether we should create role in dremio for roles fetched from ranger.

true

CUTSTOM

CONNECTOR_DREMIO_MANAGE_GROUP_MEMBERS

true

ADVANCED

CONNECTOR_DREMIO_MANAGE_USER_LIST

This property is used to set comma separated user names which access control should be managed by policysync. If you want to manage all users then you can skip specifying this property. This supports wildcards as well. The ignore users list has precedence over manage users list. Eg. user1,user2,dev_user*

ADVANCED

CONNECTOR_DREMIO_MANAGE_GROUP_LIST

This property is used to set comma separated group names which access control should be managed by policysync. If you want to manage all group then you can skip specifying this property. This supports wildcards as well. The ignore group list has precedence over manage group list. Eg. group1,group2,dev_group*

ADVANCED

CONNECTOR_DREMIO_MANAGE_ROLE_LIST

This property is used to set comma separated role names which access control should be managed by policysync. If you want to manage all role then you can skip specifying this property. This supports wildcards as well. The ignore role list has precedence over manage role list. Eg. role1,role2,dev_role*

ADVANCED

CONNECTOR_DREMIO_IGNORE_USER_LIST

This property is used to set comma separated user names which access control you don't want to be managed by policysync. If you don't want to ignore any users then you can skip specifying this property. This supports wildcards as well. This has precedence over manage users list. Eg. user1,user2,dev_user*

ADVANCED

CONNECTOR_DREMIO_IGNORE_GROUP_LIST

This property is used to set comma separated group names which access control you don't want to be managed by policysync. If you don't want to ignore any groups then you can skip specifying this property. This supports wildcards as well. This has precedence over manage groups list. Eg. group1,group2,dev_group*

ADVANCED

CONNECTOR_DREMIO_IGNORE_ROLE_LIST

This property is used to set comma separated role names which access control you don't want to be managed by policysync. If you don't want to ignore any roles then you can skip specifying this property. This supports wildcards as well. This has precedence over manage roles list. Eg. role1,role2,dev_role*

ADVANCED

CONNECTOR_DREMIO_USER_ROLE_PREFIX

This property is used to set a prefix for role which we will be creating in Dremio for user from ranger. For example if you have user named john in ranger and you have defined prefix as test_user_ then the role which we create for john in Dremio will have name test_user_john

priv_user_

ADVANCED

CONNECTOR_DREMIO_GROUP_ROLE_PREFIX

This property is used to set a prefix for role which we will be creating in Dremio for group from ranger. For example if you have group named dev in ranger and you have defined prefix as test_group_ then the role which we create for dev in Dremio will have name test_group_dev.

priv_group_

ADVANCED

CONNECTOR_DREMIO_ROLE_ROLE_PREFIX

This property is used to set a prefix for role which we will be creating in Dremio for role from ranger. For example if you have role named finance in ranger and you have defined prefix as test_role_ then the role which we create for finance in Dremio will have name test_role_finance.

priv_role_

ADVANCED

CONNECTOR_DREMIO_USE_NATIVE_PUBLIC_GROUP

Set this property to true, if you want policysync to use the "public" group from Dremio for access grants whenever there is policy created referring to public group inside it.

true

ADVANCED

CONNECTOR_DREMIO_MANAGE_USER_FILTERBY_GROUP

Set this property to true, if you want to manage only the users who belongs the the groups defined in manage groups list property.

false

ADVANCED

CONNECTOR_DREMIO_MANAGE_USER_FILTERBY_ROLE

Set this property to true, if you want to manage only the users who belongs the the roles defined in manage roles list property.

false

Access control management

ADVANCED

CONNECTOR_DREMIO_ENABLE_VIEW_BASED_MASKING

Set this property to true, if you want to enable secure view based masking in Dremio policysync.

false

ADVANCED

CONNECTOR_DREMIO_ENABLE_VIEW_BASED_ROW_FILTER

Set this property to true, if you want to enable secure view based tr filter in Dremio policysync.

false

ADVANCED

CONNECTOR_DREMIO_SECURE_VIEW_CREATE_FOR_ALL

Set this property to true, if you want to create secure view for all datasets which were created by end users. This will create secure view for datasets regardless whether there any masking/tr filter policy exists in ranger.

false

ADVANCED

CONNECTOR_DREMIO_ENABLE_ROW_FILTER

This property controls whether to enable native tr filter policy creation functionality in policysync.

true

ADVANCED

CONNECTOR_DREMIO_ENABLE_MASKING

This property controls whether to enable native masking policy creation functionality in policysync.

true

ADVANCED

CONNECTOR_DREMIO_MASKED_NUMBER_VALUE

This property is used to specify the default masking value for numeric columns

0

ADVANCED

CONNECTOR_DREMIO_MASKED_DOUBLE_VALUE

This property is used to specify the default masking value for double datatype columns

0

ADVANCED

CONNECTOR_DREMIO_MASKED_TEXT_VALUE

This property is used to specify the default masking value for text/string columns

<MASKED>'

ADVANCED

CONNECTOR_DREMIO_SECURE_SPACE_PREFIX

By default view-based tr filter and masking related secure views have the same space name as the table/view source/space name. If you want to change the secure view space name prefix and postfix, that can be done with these properties. After prefix and postfix is specified the view space name will be in this format : {prefix}{view_space_name}{postfix}

ADVANCED

CONNECTOR_DREMIO_SECURE_SPACE_POSTFIX

By default view-based tr filter and masking related secure views have the same space name as the table/view source/space name. If you want to change the secure view space name prefix and postfix, that can be done with these properties. After prefix and postfix is specified the view space name will be in this format : {prefix}{view_space_name}{postfix}

_secure

BASIC

CONNECTOR_DREMIO_GRANT_UPDATES

This property controls whether actual grant/revoke and create/update/delete queries for user/group/role should be run on Dremio.

true

ADVANCED

CONNECTOR_DREMIO_ENABLE_DATA_ADMIN

This property is used to enable data admin feature, with data admin feature enabled you can create all the policies on table/native view and by default perspective grants will be maid on secure view of table table or native view. And this secure view will have tr filter and masking capability as well. In case if you need permission on table then you can select the permission you want plus DataAdmin in the policy, In this case that permissions will be granted on both, the table/native view and its secure view as well.

false

Access audits management

BASIC

CONNECTOR_DREMIO_AUDIT_ENABLE

This property is used to enable access audit fetching from Dremio.

true

ADVANCED

CONNECTOR_DREMIO_AUDIT_EXCLUDED_USERS

This property is used to exclude the users while pushing the audits logs to ranger access audits. Recommended to set this as JDBC user name as there will be audits from policysync application.

{{DREMIO_JDBC_USERNAME}}

JDBC configuration properties

BASIC

CONNECTOR_MSSQL_JDBC_URL

This property is used to set jdbc url which can be used to connect to Mssql server. JDBC URL should follow below convention jdbc:sqlserver://<MSSQL_SERVER_HOST>:<MSSQL_SERVER_PORT> Example :- jdbc:sqlserver://example.database.windows.net:1433

BASIC

CONNECTOR_MSSQL_JDBC_USERNAME

This property is used to set jdbc Username to be used to make connection to MSSQL.

BASIC

CONNECTOR_MSSQL_JDBC_PASSWORD

This property is used to set jdbc username password to be used to make connection to MSSQL.

BASIC

CONNECTOR_MSSQL_MASTER_DB

This property is used to set jdbc master database to be used to make initial connection to Mssql.

master

BASIC

CONNECTOR_MSSQL_AUTHENTICATION_TYPE

If MSSQL_JDBC_USERNAME is a 'local user', set value as below: MSSQL_AUTHENTICATION_TYPE: "SqlPassword" If MSSQL_JDBC_USERNAME is an Azure AD user, then set as below: MSSQL_AUTHENTICATION_TYPE: "ActiveDirectoryPassword"

SqlPassword

SqlPassword/ActiveDirectoryPassword

BASIC

CONNECTOR_MSSQL_DEFAULT_USER_PASSWORD

This property is used to set password to every new user created by policysync in MSSQL.

BASIC

CONNECTOR_MSSQL_OWNER_ROLE

This property is used to set ownership for all the resources managed by policysync. The specified role will become owner for all managed resources and will have full control on those resources.We support changing owners of database, schema, tables and views. Note :- If owner role is kept as blank, then ownership will not change and users who creates table/view or any other object he will be owner of those objects and policysync won't be able to do access control on that object

Resources management

ADVANCED

CONNECTOR_MSSQL_MANAGE_DATABASE_LIST

This property is used to set database name for which access control should be managed by policysync. The ignore database list has precedence over manage database list. Eg. testdb1 Note: For mssql connector we support only 1 database at a time for access control, providing the multiple databases list here will not work, value for this property are case-sensitive.

ADVANCED

CONNECTOR_MSSQL_MANAGE_SCHEMA_LIST

This property is used to set list of comma separated schema names/wildcards for schema names of database to be managed by policysync. Not specifying this property indicates manage all schemas. Schemas should be specified in format of <database>.<schema> Note: values for this property are case-sensitive.

ADVANCED

CONNECTOR_MSSQL_MANAGE_TABLE_LIST

This property is used to set list of comma separated tables names/wildcards for table names of the managed schema to be managed by policysync. Not specifying this property indicates manage all tables. tables should be specified in format of <database>.<schema>.<table> Note: values for this property are case-sensitive.

ADVANCED

CONNECTOR_MSSQL_IGNORE_DATABASE_LIST

This property is used to set comma separated database names which access control you don't want to be managed by policysync. If you don't want to ignore any database then you can skip specifying this property. This supports wildcards as well. This has precedence over manage database list. Eg. testdb1,testdb2,sales_db* Note: values for this property are case-sensitive.

ADVANCED

CONNECTOR_MSSQL_IGNORE_SCHEMA_LIST

This property is used to set comma separated schema fqdn which access control you don't want to be managed by policysync. If you don't want to ignore any schema then you can skip specifying this property. This supports wildcards as well. This has precedence over manage schema list. Eg. testdb1.schema1,testdb2.schema2,sales_db*.sales* Note: values for this property are case-sensitive.

Users/Groups/Roles management

ADVANCED

CONNECTOR_MSSQL_USER_NAME_REPLACE_FROM_REGEX

This takes the regular expression as input and finds the matching characters in a user name and replaces them with the characters specified in property. If kept blank, no find and replace operation is performed.

[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]

ADVANCED

CONNECTOR_MSSQL_USER_NAME_REPLACE_TO_STRING

The value specified in this property is used to replace the characters found by the regex specified user name regex property. If kept blank, no find and replace operation is performed.

_

ADVANCED

CONNECTOR_MSSQL_GROUP_NAME_REPLACE_FROM_REGEX

This takes the regular expression as input and finds the matching characters in a group name and replaces them with the characters specified in property. If kept blank, no find and replace operation is performed.

[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]

ADVANCED

CONNECTOR_MSSQL_GROUP_NAME_REPLACE_TO_STRING

The value specified in this property is used to replace the characters found by the regex specified group name regex property. If kept blank, no find and replace operation is performed.

_

ADVANCED

CONNECTOR_MSSQL_ROLE_NAME_REPLACE_FROM_REGEX

This takes the regular expression as input and finds the matching characters in a role name and replaces them with the characters specified in property. If kept blank, no find and replace operation is performed.

[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]

ADVANCED

CONNECTOR_MSSQL_ROLE_NAME_REPLACE_TO_STRING

The value specified in this property is used to replace the characters found by the regex specified role name regex property. If kept blank, no find and replace operation is performed.

_

ADVANCED

CONNECTOR_MSSQL_USER_NAME_PERSIST_CASE_SENSITIVITY

After loading user from Ranger API's all are converted into lowercase, but in some cases, you would need to have the users in the same case as they are in Ranger. When setting this value to true, it will maintain the case sensitivity of names as they are in Ranger.

false

true/false

ADVANCED

CONNECTOR_MSSQL_GROUP_NAME_PERSIST_CASE_SENSITIVITY

After loading group from Ranger API's all are converted into lowercase, but in some cases, you would need to have the groups in the same case as they are in Ranger. When setting this value to true, it will maintain the case sensitivity of names as they are in Ranger.

false

true/false

ADVANCED

CONNECTOR_MSSQL_ROLE_NAME_PERSIST_CASE_SENSITIVITY

After loading role from Ranger API's all are converted into lowercase, but in some cases, you would need to have the roles in the same case as they are in Ranger. When setting this value to true, it will maintain the case sensitivity of names as they are in Ranger.

false

true/false

CONNECTOR_MSSQL_USER_NAME_CASE_CONVERSION

This property only applicable if USER NAME PERSIST CASE SENSITIVITY is set to false. Managed users name would be treated as lowercase by default. If the value is set to "upper" then the user name would be treated as uppercase. If the value is set to "none" then the user name case is preserved.

lower

none, lower, upper