Ranger authorization policies

Ozone supports two authorization models: Native ACLs and Apache Ranger policies.

• Native ACLs are managed through Ozone's command-line interface or APIs and are stored internally within Ozone's metadata. They are suitable for simpler security requirements and for environments where Ozone is run as a standalone service.
• Apache Ranger provides centralized security administration for the entire Hadoop ecosystem. If you are already using Ranger to manage permissions for other components like HDFS, Hive, or HBase, integrating Ozone with Ranger allows you to manage all access policies in one place. Ranger offers a user-friendly UI, centralized auditing, and more advanced policy features. For more information about configuring Apache Ranger authorization for Ozone, refer to configuring Apache Ranger.

When Ranger is enabled, it becomes the sole authority for access control, and native ACLs are ignored.

Permission comparison table

The table below shows the mapping between Ozone operations and the required Ranger permissions. An Ozone Manager plugin synchronizes these policies from Ranger.