Apache Ranger

Overview

Apache Ranger is a framework for managing data security across the Hadoop ecosystem, providing central policy administration, fine-grained authorisation and centralised auditing across more than twenty services.

Its enforcement model is categorically different from the commercial tools here. Ranger is a lightweight Java plugin running inside the engine's own process, not a proxy, not a view generator and not a pusher of policy into warehouses.

So it never rewrites a query from outside, never creates secure views, and never sits in the connection path. It answers allow or deny in process, applying row filters and column masks as the engine executes.

Be blunt about scope, because this is where buyers go wrong. It ships no plugin or service definition for Snowflake, Databricks Unity Catalog, BigQuery, Redshift, Synapse or Fabric.

What it does cover is the open-source estate: HDFS, Hive, HBase, Kafka, Knox, YARN, Storm, Solr, Sqoop, Ozone, NiFi, Atlas, Elasticsearch, Presto and Trino, plus Azure storage and now Polaris-managed Iceberg catalogues.

It also does not discover or classify data. There is no scanner and no classifier; tags come from an external catalogue, canonically Apache Atlas, through its tag synchronisation service and then drive policy.

Policy models are richer than that gap suggests, covering role, attribute and tag-based control, with security zones delegating administration by data boundary.

Version 2.9.0, released in August 2026, changes the architectural story with a standalone policy decision server answering over REST and a thin client library, so it need no longer be co-located with every engine.

It is genuinely maintained, with two releases a year recently and hundreds of commits in 2026, after a long gap earlier in the decade.

One governance note worth knowing in a vendor-neutral directory: its steward is the Apache foundation, but a co- founder of Privacera is among its most prolific contributors.

Key features and capabilities

The same headings are used for every access policy enforcement entry, so two tools can be read side by side.

How policies are written

• Role-based, attribute-based and tag-based access control are all first-class
• Policies are authored in the admin interface or the REST API, against a per-service definition
• There is no SQL, no natural language and no policy-as-code surface
• Tag-based policies are the reuse mechanism, applying wherever tag synchronisation places that tag
• Security zones delegate policy administration per data boundary within one installation

How policies are enforced

• A lightweight Java plugin running inside the engine's own process, for every supported service
• Plugins pull policy from the admin server, cache it locally, then evaluate each request in process
• No query rewriting from outside, no generated views, no proxy and no push into warehouse primitives
• Row filtering and column masking are performed by the plugin, most maturely in the Hive plugin
• Version 2.9.0 adds a standalone decision server answering over REST, plus a thin remote client

Masking and de-identification

• Column masking and row filtering as policy types evaluated in the plugin
• Hive-style mask types include hashing, nullify, redact, show first or last characters and date year only
• A key management service provides keys for transparent encryption at rest rather than dynamic masking
• A nested structure plugin provides masking for JSON and nested data
• Tokenisation, differential privacy and k-anonymisation are not published

Classification and discovery

• Ranger does not discover or classify data at all; there is no scanner and no classifier
• This is its single biggest functional gap against the commercial alternatives
• Tags are consumed from an external catalogue, canonically Apache Atlas, through tag synchronisation
• Ranger also secures Atlas itself, authorising access to the metadata
• Any classification must therefore come from another tool entirely

Platform coverage

• 26 service definitions shipped, covering HDFS, Hive, HBase, Kafka, Knox, YARN, Storm, Solr and Sqoop
• Also Ozone, NiFi, Atlas, Elasticsearch, Kudu, Kylin, Schema Registry, Presto and Trino
• Azure Data Lake Storage and Blob storage are covered by service definitions
• A Polaris definition arrived in 2.9.0, its first move toward open table formats
• No Snowflake, Databricks, BigQuery, Redshift, Synapse, Fabric, Athena or Lake Formation support exists

Audit and monitoring

• Centralised auditing of access and administrative actions is a stated project goal
• Plugins emit records through an audit module, with a dedicated audit server and pluggable sinks
• Records are viewable and searchable in the admin interface
• A metrics module reports on the Ranger services themselves
• Anomaly detection on access behaviour is not published; it records access but does not analyse it

Where it runs and what it costs

• Self-hosted only; there is no managed or vendor-operated option from the project
• You run the admin server, a policy database, user and tag synchronisation, and optionally key management
• Docker images are published from 2.4.0 onward, with high availability and an embedded web server module
• Plugins deploy into each engine's process, as libraries, coprocessors or init scripts
• The new decision server allows a service-oriented deployment away from every engine

Pricing

Open sourceFree, Apache 2.0

Free and open source under Apache 2.0, with no licence fee, tier, metering, commercial edition or trial concept from the project. You download binaries or source from the foundation, or pull artefacts from Maven Central and Docker Hub. The only costs are your own infrastructure and the operational work of running the admin server, policy database and synchronisation services, plus deploying and upgrading a plugin inside every engine you want governed. Commercial vendors package and support it separately, priced under their own entries.

Vendor pricing page →

Demos and videos

• Apache Ranger documentation Tutorial · ranger.apache.org
• Apache Ranger release notes and downloads Tutorial · ranger.apache.org

About Apache Software Foundation

Ranger is an Apache Software Foundation project, licensed Apache 2.0 and run as a volunteer meritocracy with a project management committee and committers, where anyone can contribute and earn a vote over time. Decisions, votes and releases happen on public mailing lists, with every change tied to a tracked issue. Its first incubating release was in 2014, though the graduation date is not published on its own pages. The repository has around 242 contributors and remains active, with over three hundred commits in 2026. Its top contributors include the co-founder and chief technology officer of Privacera, a commercial vendor in the same category.

Founded 2014 · ranger.apache.org