{"id":15929421,"url":"https://github.com/izhangzhihao/spark-security","last_synced_at":"2025-08-15T22:30:51.393Z","repository":{"id":110944158,"uuid":"440153863","full_name":"izhangzhihao/spark-security","owner":"izhangzhihao","description":null,"archived":false,"fork":false,"pushed_at":"2021-12-23T02:29:08.000Z","size":146,"stargazers_count":4,"open_issues_count":0,"forks_count":3,"subscribers_count":3,"default_branch":"master","last_synced_at":"2024-10-29T04:41:02.473Z","etag":null,"topics":["ranger","ranger-plugin","security","spark","spark-sql","sql"],"latest_commit_sha":null,"homepage":"","language":"Scala","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/izhangzhihao.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-12-20T11:57:57.000Z","updated_at":"2024-05-01T10:25:24.000Z","dependencies_parsed_at":null,"dependency_job_id":"6a169367-6f75-48e0-99cf-a66d000ddbd7","html_url":"https://github.com/izhangzhihao/spark-security","commit_stats":{"total_commits":1,"total_committers":1,"mean_commits":1.0,"dds":0.0,"last_synced_commit":"fdfff97f8cc6d4b6520496d52a15c03b593c4ef1"},"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/izhangzhihao%2Fspark-security","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/izhangzhihao%2Fspark-security/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/izhangzhihao%2Fspark-security/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/izhangzhihao%2Fspark-security/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/izhangzhihao","download_url":"https://codeload.github.com/izhangzhihao/spark-security/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":229964396,"owners_count":18152034,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ranger","ranger-plugin","security","spark","spark-sql","sql"],"created_at":"2024-10-07T00:03:50.005Z","updated_at":"2024-12-16T13:09:34.480Z","avatar_url":"https://github.com/izhangzhihao.png","language":"Scala","funding_links":[],"categories":[],"sub_categories":[],"readme":"\nSubmarine Spark Security Plugin is built using [Apache Maven](http://maven.apache.org). To build it, `cd` to the root direct of submarine project and run:\n\n```bash\nmvn clean package -Dmaven.javadoc.skip=true -DskipTests -pl :submarine-spark-security\n```\n\nBy default, Submarine Spark Security Plugin is built against Apache Spark `2.3.x` and Apache Ranger `1.1.0`, which may be incompatible with other Apache Spark or Apache Ranger releases.\n\nCurrently, available profiles are:\n\n**Spark**: `-Pspark-2.3`, `-Pspark-2.4`, `-Pspark-3.0`\n\n**Ranger**: `-Pranger-1.2`, `-Pranger-2.0`, `-Pranger-2.1`\n\n\nACL Management for Apache Spark SQL with Apache Ranger, enabling:\n\n- Table/Column level authorization\n- Row level filtering\n- Data masking\n\n\nSecurity is one of fundamental features for enterprise adoption. [Apache Ranger™](https://ranger.apache.org) offers many security plugins for many Hadoop ecosystem components, \nsuch as HDFS, Hive, HBase, Solr and Sqoop2. However, [Apache Spark™](http://spark.apache.org) is not counted in yet. \nWhen a secured HDFS cluster is used as a data warehouse accessed by various users and groups via different applications wrote by Spark and Hive, \nit is very difficult to guarantee data management in a consistent way.  Apache Spark users visit data warehouse only \nwith Storage based access controls offered by HDFS. This library enables Spark with SQL Standard Based Authorization. \n\n## Build\n\nPlease refer to the online documentation - [Building submarine spark security plguin](build-submarine-spark-security-plugin.md)\n\n## Quick Start\n\nThree steps to integrate Apache Spark and Apache Ranger.\n\n### Installation\n\nPlace the submarine-spark-security-\u0026lt;version\u0026gt;.jar into `$SPARK_HOME/jars`.\n\n### Configurations\n\n#### Settings for Apache Ranger\n\nCreate `ranger-spark-security.xml` in `$SPARK_HOME/conf` and add the following configurations\nfor pointing to the right Apache Ranger admin server.\n\n\n```xml\n\n\u003cconfiguration\u003e\n\n    \u003cproperty\u003e\n        \u003cname\u003eranger.plugin.spark.policy.rest.url\u003c/name\u003e\n        \u003cvalue\u003ehttps://10.102.13.36:6182\u003c/value\u003e\n    \u003c/property\u003e\n\n    \u003cproperty\u003e\n        \u003cname\u003eranger.plugin.spark.policy.rest.ssl.config.file\u003c/name\u003e\n        \u003cvalue\u003e/etc/spark/conf/ranger-spark-policymgr-ssl.xml\u003c/value\u003e\n    \u003c/property\u003e\n\n    \u003cproperty\u003e\n        \u003cname\u003eranger.plugin.spark.service.name\u003c/name\u003e\n        \u003cvalue\u003ecm_hive\u003c/value\u003e\n    \u003c/property\u003e\n\n    \u003cproperty\u003e\n        \u003cname\u003eranger.plugin.spark.policy.cache.dir\u003c/name\u003e\n        \u003cvalue\u003e/tmp\u003c/value\u003e\n    \u003c/property\u003e\n\n    \u003cproperty\u003e\n        \u003cname\u003eranger.plugin.spark.policy.pollIntervalMs\u003c/name\u003e\n        \u003cvalue\u003e5000\u003c/value\u003e\n    \u003c/property\u003e\n\n    \u003cproperty\u003e\n        \u003cname\u003eranger.plugin.spark.policy.source.impl\u003c/name\u003e\n        \u003cvalue\u003eorg.apache.ranger.admin.client.RangerAdminRESTClient\u003c/value\u003e\n    \u003c/property\u003e\n\n\u003c/configuration\u003e\n```\n\nCreate `ranger-spark-audit.xml` in `$SPARK_HOME/conf` and add the following configurations\nto enable/disable auditing.\n\n```xml\n\u003cconfiguration\u003e\n    \u003cproperty\u003e\n        \u003cname\u003exasecure.audit.is.enabled\u003c/name\u003e\n        \u003cvalue\u003etrue\u003c/value\u003e\n    \u003c/property\u003e\n\u003c/configuration\u003e\n\n\nranger-spark-policymgr-ssl.xml\n\n\u003cconfiguration xmlns:xi=\"http://www.w3.org/2001/XInclude\"\u003e\n\t\u003cproperty\u003e\n    \u003cname\u003exasecure.policymgr.clientssl.truststore\u003c/name\u003e\n    \u003cvalue\u003e/home/bigdatauser/cm-auto-global_truststore.jks\u003c/value\u003e\n  \u003c/property\u003e\n  \u003cproperty\u003e\n    \u003cname\u003exasecure.policymgr.clientssl.truststore.credential.file\u003c/name\u003e\n    \u003cvalue\u003ejceks://file/home/bigdatauser/ranger-truststore.jceks\u003c/value\u003e\n  \u003c/property\u003e\n  \u003cproperty\u003e\n    \u003cname\u003exasecure.policymgr.clientssl.keystore\u003c/name\u003e\n    \u003cvalue\u003e/home/bigdatauser/cm-auto-host_keystore.jks\u003c/value\u003e\n  \u003c/property\u003e\n  \u003cproperty\u003e\n    \u003cname\u003exasecure.policymgr.clientssl.keystore.credential.file\u003c/name\u003e\n    \u003cvalue\u003ejceks://file/home/bigdatauser/ranger-keystore.jceks\u003c/value\u003e\n  \u003c/property\u003e\n  \u003cproperty\u003e\n    \u003cname\u003exasecure.policymgr.clientssl.keystore.type\u003c/name\u003e\n    \u003cvalue\u003ejks\u003c/value\u003e\n  \u003c/property\u003e\n  \u003cproperty\u003e\n    \u003cname\u003exasecure.policymgr.clientssl.truststore.type\u003c/name\u003e\n    \u003cvalue\u003ejks\u003c/value\u003e\n  \u003c/property\u003e\n\u003c/configuration\u003e\n\n```\n\n#### Settings for Apache Spark-\n\nYou can configure `spark.sql.extensions` with the `*Extension` we provided.\nFor example, `spark.sql.extensions=org.apache.submarine.spark.security.api.RangerSparkAuthzExtension`\n\nCurrently, you can set the following options to `spark.sql.extensions` to choose authorization w/ or w/o\nextra functions.\n\n| option | authorization | row filtering | data masking |\n|---|---|---|---|\n|org.apache.submarine.spark.security.api.RangerSparkAuthzExtension| √ | × | × |\n|org.apache.submarine.spark.security.api.RangerSparkSQLExtension| √ | √ | √ |\n\n\n\n## Apache Submarine Community\n\nRead the [Apache Submarine Community Guide](https://submarine.apache.org/docs/community/README)\n\nHow to contribute [Contributing Guide](https://submarine.apache.org/docs/community/contributing)\n\nIssue Tracking: https://issues.apache.org/jira/projects/SUBMARINE\n\n## User Document\n\nSee [User Guide Home Page](https://submarine.apache.org/docs/)\n\n## Developer Document\n\nSee [Developer Guide Home Page](https://submarine.apache.org/docs/devDocs/Development/)\n\n## Roadmap\n\nWhat to know more about what's coming for Submarine? Please check the roadmap out: https://cwiki.apache.org/confluence/display/SUBMARINE/Roadmap\n\n## License\n\nThe Apache Submarine project is licensed under the Apache 2.0 License. See the [LICENSE](./LICENSE) file for details.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fizhangzhihao%2Fspark-security","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fizhangzhihao%2Fspark-security","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fizhangzhihao%2Fspark-security/lists"}