Apache Sentry vs. Ranger: Comparing Big Data Permission Management Frameworks

Introduction

This article introduces two popular big‑data permission‑management frameworks, Apache Sentry and Apache Ranger, and explains how they implement role‑based access control (RBAC) for Hadoop components.

Sentry Overview

Architecture Model

DataEngine : refers to the data applications such as HDFS, Hive and Impala.

Plugin : communicates with the Sentry Server to synchronize policy metadata and performs authentication.

Policy metadata : stores permission policies in an external database.

Sentry integrates tightly with Hive, HDFS and Impala. An additional cache layer in HDFS periodically pulls Hive metadata and Sentry permissions to keep them consistent and improve performance. The Sentry Server also includes an audit module that records all access requests.

Ranger Overview

General Advantages

Supports a broader set of upper‑layer components (HDFS, Hive, HBase, Yarn, Storm, Knox, Kafka, Solr, NiFi).

Controls more resource types, including files, directories, tables, rows, and columns.

Architecture Model

Ranger’s policy engine runs as a plugin that pulls policies from the admin server, allowing continued operation even if the admin server is temporarily unavailable.

Policy Configuration

Administrators define policies through the Ranger admin web UI. Example of user ACL control:

Table: customer
+----+------------+-----------+--------------+---------------+----------------+
| id | name_first | name_last | addr_country | date_of_birth | phone_num      |
+----+------------+-----------+--------------+---------------+----------------+
| 1  | Mackenzy   | Smith     | US           | 1993-12-18    | 123-456-7890   |
| 2  | Sherlyn    | Miller    | US           | 1975-03-22    | 234-567-8901   |
| …  | …          | …         | …            | …             | …              |
+----+------------+-----------+--------------+---------------+----------------+

When a user runs select * from cust.customer, all rows are returned. After defining group‑to‑user mappings (e.g., us-employees → john, scott) and configuring a row‑level filter in Ranger, the same query executed by john returns only rows where addr_country = 'US':

[john@localhost ~]$ beeline -u jdbc:hive2://localhost.localdomain:10000/cust
0: jdbc:hive2://localhost.localdomain:10000> select * from cust.customer;
+-----+-------------+------------+---------------+----------------+--------------+
| id  | name_first  | name_last  | addr_country  | date_of_birth  | phone_num    |
+-----+-------------+------------+---------------+----------------+--------------+
| 1   | Mackenzy    | Smith      | US            | 1993-12-18     | 123-456-7890 |
| 2   | Sherlyn     | Miller     | US            | 1975-03-22     | 234-567-8901 |
| 3   | Khiana      | Wilson     | US            | 1989-08-14     | 345-678-9012 |
| 4   | Jack        | Thompson   | US            | 1962-10-28     | 456-789-0123 |
+-----+-------------+------------+---------------+----------------+--------------+

Ranger also supports column‑level masking. After configuring a mask on the phone_num column, query results show the phone numbers partially obscured:

+-----+-------------+------------+---------------+----------------+--------------+
| id  | name_first  | name_last  | addr_country  | date_of_birth  | phone_num    |
+-----+-------------+------------+---------------+----------------+--------------+
| 1   | Mackenzy    | NULL       | US            | 1993-01-01     | xxx-xxx-7890 |
| 2   | Sherlyn     | NULL       | US            | 1975-01-01     | xxx-xxx-8901 |
| 3   | Khiana      | NULL       | US            | 1989-01-01     | xxx-xxx-9012 |
+-----+-------------+------------+---------------+----------------+--------------+

Policy Flexibility

Ranger policies can include tag‑based controls, eliminating the need to consider component differences, and support conditional expressions defined by administrators.

Conclusion

Both frameworks are similar in providing RBAC for Hadoop ecosystems. Sentry offers tighter integration with Hive, HDFS and Impala due to its origins at Cloudera, while Ranger provides a more generic solution with richer policy features and broader component support.