@Rocky to grant SHOW CREATE VIEW permission to a user what permission should I give in ranger?

To grant a user the permission to execute

SHOW CREATE VIEW

in StarRocks while using Apache Ranger for authorization, you should assign the

select

permission in your Ranger policy. Required Ranger Permissions According to StarRocks documentation and the standard Ranger service definition: 1. On the View Resource: * Permission:

select

* Resource Type:

view

(In some StarRocks versions/configurations, you may need to grant this on the

table

resource if the view is treated as a table). 2. On the Base Tables (Underlying data): * Permission:

select

* Resource Type:

table

* Note:

SHOW CREATE VIEW

requires the

SELECT

privilege on both the view itself and all the base tables or views that the view references. Important Notes for Specific Versions * Version 3.3.x and earlier: There is a known behavior where StarRocks might perform an authorization check against the

table

resource instead of the

view

resource for certain commands. If granting

select

on the

view

resource results in an "Access denied" error referencing a "TABLE", try granting the

select

permission on that object under the Table policy in Ranger. * Secure Views (v3.4.1+): If the view was created with

SECURITY INVOKER

, the user must have

SELECT

privileges on the underlying base tables to see the view definition or query it. If created with

SECURITY NONE

(default), only the privilege on the view itself is strictly required by the SQL engine for basic metadata, but

SELECT

on base tables is still standard for

SHOW CREATE VIEW

to prevent leaking the underlying schema to unauthorized users. Summary for Ranger Admin UI: * Service: StarRocks * Policy Type: Access * Resources:

catalog

->

database

->

view

(or

table

) * Permissions: Select

select

for the target user/group. References • administration/user_privs/authorization/ranger_plugin.md • administration/user_privs/authorization/privilege_item.md

@Rocky user permissions on all underneath tables but still cant run SHOW CREATE VIEW

To execute

SHOW CREATE VIEW

in StarRocks with Apache Ranger, you must grant the

select

permission. However, there is a common pitfall in how StarRocks communicates with Ranger that often leads to "Access Denied" even when the base table permissions are correct. 1. The Requirement StarRocks requires the

SELECT

privilege on both: * The view itself. * All underlying base tables (or other views) that the view references. 2. The Ranger "Table vs. View" Resource Bug In many StarRocks versions (including v3.1 through v3.5), there is a known behavior where the StarRocks Ranger plugin checks for permissions against the

table

resource type in Ranger, even when you are performing an operation on a

view

. If you have granted

select

on the view under a "View" policy in Ranger but it still fails, try the following: * Create a policy for the view name under the

table

resource type in the Ranger StarRocks service. * Assign the

select

permission to the user/role in that Table policy. 3. Verification Checklist If it still doesn't work, verify these points: * Base Table Resource: Ensure the user has

select

on all base tables in Ranger (you mentioned this is done, but double-check that the policy includes the specific

catalog.database.table

path). * Policy Refresh: Ranger policies can take 30–60 seconds to sync to the StarRocks FE. You can check the FE logs (

fe.log

) for any

AccessControlException

to see exactly which resource and action Ranger is denying. * Information Schema: Check if the user can see the view metadata by running:

sql
    SELECT * FROM information_schema.views WHERE table_name = 'your_view_name';

If this returns empty or fails, the view-level permission is definitely missing in Ranger. Summary of Ranger Configuration: Resource Type | Object Name | Required Action Table |

your_view_name

|

select

Table |

base_table_name(s)

|

select

View (Optional/Fallback) |

your_view_name

|

select

Note: If you are on version v3.3.0 or later, ensure your Ranger service definition (

ranger-servicedef-starrocks.json

) is up to date with the version provided in the StarRocks GitHub repository. References • sql-reference/sql-statements/View/SHOW_CREATE_VIEW.md • sql-reference/sql-statements/account-management/SHOW_GRANTS.md • administration/user_privs/authorization/privilege_item.md • sql-reference/sql-statements/table_bucket_part_index/SHOW_CREATE_TABLE.md • administration/user_privs/authorization/User_privilege.md • administration/user_privs/authorization/ranger_plugin.md

@Rocky r replicas num: 0, unknown replicas num: 0, write cost: 26ms 2026-07-14 173705.740+05:00 WARN (starrocks-mysql-nio-pool-5166|141573) [StmtExecutor.logOptimizerTraceOnGenerateExecPlanFailure():692] Generate exec plan failed. Planner profile: query_id=b8c119bd-7f80-11f1-9659-badfa49bcca7, sql=/* ApplicationName=DBeaver 25.2.3 - SQLEditor <Console> */ SHOW CREATE VIEW default_catalog.external_sandbox.Activity_ui, err=ErrorReportException: Access denied; you need (at least one of) the ANY privilege(s) on TABLE Activity_ui for this operation., profile=Planner: - -- Parser[1] 0 - -- Total[1] 0 Reason: 2026-07-14 173705.740+05:00 WARN (starrocks-mysql-nio-pool-5166|141573) [StmtExecutor.execute():984] execute Exception, sql: /* ApplicationName=DBeaver 25.2.3 - SQLEditor <Console> */ SHOW CREATE VIEW default_catalog.external_sandbox.Activity_ui com.starrocks.common.ErrorReportException: Access denied; you need (at least one of) the ANY privilege(s) on TABLE Activity_ui for this operation. at com.starrocks.common.ErrorReportException.report(ErrorReportException.java:38) ~[starrocks-fe.jar:?] at com.starrocks.authorization.AccessDeniedException.reportAccessDenied(AccessDeniedException.java:44) ~[starrocks-fe.jar:?] at com.starrocks.sql.analyzer.AuthorizerStmtVisitor.visitShowCreateTableStatement(AuthorizerStmtVisitor.java:1822) ~[starrocks-fe.jar:?] at com.starrocks.sql.analyzer.AuthorizerStmtVisitor.visitShowCreateTableStatement(AuthorizerStmtVisitor.java:246) ~[starrocks-fe.jar:?] at com.starrocks.sql.ast.ShowCreateTableStmt.accept(ShowCreateTableStmt.java:115) ~[starrocks-fe.jar:?] at com.starrocks.sql.ast.AstVisitor.visit(AstVisitor.java:102) ~[starrocks-fe.jar:?] at com.starrocks.sql.analyzer.AuthorizerStmtVisitor.check(AuthorizerStmtVisitor.java:258) ~[starrocks-fe.jar:?] at com.starrocks.sql.analyzer.Authorizer.check(Authorizer.java:60) ~[starrocks-fe.jar:?] at com.starrocks.qe.StmtExecutor.generateExecPlan(StmtExecutor.java:610) ~[starrocks-fe.jar:?] at com.starrocks.qe.StmtExecutor.execute(StmtExecutor.java:752) ~[starrocks-fe.jar:?] at com.starrocks.qe.ConnectProcessor.executeQueryAttempt(ConnectProcessor.java:535) ~[starrocks-fe.jar:?] at com.starrocks.qe.ConnectProcessor.runWithParserStageRetry(ConnectProcessor.java:433) ~[starrocks-fe.jar:?] at com.starrocks.qe.ConnectProcessor.handleQuery(ConnectProcessor.java:370) ~[starrocks-fe.jar:?] at com.starrocks.qe.ConnectProcessor.dispatch(ConnectProcessor.java:746) ~[starrocks-fe.jar:?] at com.starrocks.qe.ConnectProcessor.processOnce(ConnectProcessor.java:1137) ~[starrocks-fe.jar:?] at com.starrocks.mysql.nio.ReadListener.lambda$handleEvent$0(ReadListener.java:71) ~[starrocks-fe.jar:?] at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) ~[?:?] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) ~[?:?] at java.lang.Thread.run(Thread.java:840) ~[?:?] 2026-07-14 173705.892+05:00 INFO (replayer|137) [DatabaseTransactionMgr.replayUpsertTransac

The error message

Access denied; you need (at least one of) the ANY privilege(s) on TABLE Activity_ui

reveals that StarRocks is performing the authorization check for your view using the TABLE resource type in Ranger, rather than the VIEW resource type. To resolve this, follow these steps in your Ranger Admin UI: 1. Grant Permissions on the View Name as a "Table" Even though

Activity_ui

is a view, the StarRocks Ranger plugin (in current versions) checks for permissions against the

table

resource for this command. * Resource:

catalog=default_catalog

->

database=external_sandbox

->

table=Activity_ui

* Permission: Grant

select

to the user. * Why: StarRocks requires the user to have "any" privilege on the object to describe it. In Ranger, "ANY" is satisfied by granting

select

. 2. Verify Underlying Table Permissions As you mentioned these are already granted, ensure they are also using the

select

permission.

SHOW CREATE VIEW

strictly requires the

SELECT

privilege on: 1. The View itself (checked as a

TABLE

resource in Ranger). 2. Every base table referenced in the view definition. 3. Why you see "ANY privilege" In StarRocks,

SHOW

commands (like

SHOW CREATE VIEW

or

SHOW TABLES

) use a "metadata visibility" check. The error message

ANY privilege(s)

means the system is asking Ranger: "Does this user have at least one permission (any of SELECT, INSERT, ALTER, etc.) on this object?" * If Ranger returns

false

for all possible actions on that specific resource name, you get this error. * Granting

select

is the standard way to satisfy this "ANY" requirement. Summary of the fix: Ranger Resource | Object Name | Required Action Table |

Activity_ui

(The View) |

select

Table |

...

(Base Tables) |

select

Note: If your Ranger policy for

Activity_ui

is currently defined under a View resource type, StarRocks may be ignoring it due to a known architectural behavior where it maps view-metadata queries to table-resource checks. Move or duplicate that policy to the *Table*Table* resource* type. Table** resource type. References • administration/user_privs/authorization/User_privilege.md • administration/user_privs/authorization/privilege_faq.md • administration/user_privs/authorization/privilege_item.md • sql-reference/information_schema/table_privileges.md • sql-reference/sys/grants_to_roles.md • data_source/catalog/hive_catalog.md