Hi Team I m trying to integrate Apache Ranger with StarRocks StarRocks #questions-and-troubleshooting

Hi Team, I'm trying to integrate Apache Ranger wit...

Mohan

10/07/2025, 7:44 PM

Hi Team, I'm trying to integrate Apache Ranger with StarRocks, all tables are accessible as per policies but if I run any query directly on view it is accessible and showing data even though policy is restricted. Am I missing something here? StarRocks version - 3.4.2 and Ranger - 2.4.1

Mohan

10/09/2025, 3:38 AM

Could someone check this please?

Robert Raharjo

10/10/2025, 10:08 PM

Can you share the ranger policies that you used?

Mohan

10/12/2025, 6:42 PM

I have policies like this in attached screenshot, I have multi tenant architecture.

demo

is one tenant and it should have access to only demo_events,demo tables and demo views, similarly for all different tenants I have same policies, but with demo user I can able to read views directly from other databases but If I run show databases/show tables in otherdb, I can't see any tables/views. If I run

select * from <othertenantdb>.<view>, it is showing data

but same query on table of othertenantdb, it is denying like

Copy code

select * from <othertenantdb>.<table> - access denied

May I know if something wrong here or policies can't be applied to starrocks views?

Mohan

10/13/2025, 7:26 PM

@Robert Raharjo could you pls check once?

Mohan

10/14/2025, 9:41 PM

Any inputs on this?

Mohan

10/25/2025, 11:51 AM

@Robert Raharjo

Giorgi Chitashvili

02/16/2026, 10:23 AM

Hi we have same issue with 3.5.12 starrocks, seems view access dont works. In our configuration we create user in starrocks with 0 grants and we even didnt added it in ranger however this user has access to select any views.

Giorgi Chitashvili

02/16/2026, 10:25 AM

Root cause: A bug in StarRocks source code (

ColumnPrivilege.java

). When

access_control = ranger

is enabled, the authorization check for views is completely skipped. The code only performs column-level checks via the query optimizer, but views are not physical scan operators, so the column set comes back empty and no privilege check runs at all. The proper

checkViewAction()

call only exists in the native RBAC branch and is never reached when Ranger is active. https://github.com/StarRocks/starrocks/blob/branch-3.5/fe/fe-core/src/main/java/com/starrocks/authorization/ColumnPrivilege.java

Mohan

02/17/2026, 2:35 PM

@Giorgi Chitashvili any fix for this in latest starrocks version or any bug raised?

Giorgi Chitashvili

02/18/2026, 5:58 AM

Hi, seems its no fix or bug reports.

Open in Slack

Previous Next