Tag Sync (OpenMetadata & Ranger Integration)

The Tag Sync feature synchronizes tags from OpenMetadata to Apache Ranger, extending permission management in Trino to be based on tags (in addition to resources).

Steps

Step 1: Portal

On the Portal, you need to create all 3 components:

1. OpenMetadata
2. Apache Ranger
3. Trino

When creating the Trino cluster, you must check Integrate Ranger to allow Trino to use permissions from Ranger.

Step 2: Create Resource Policies for Trino in Ranger

Go to Ranger > Service Manager > Resource tab → select the Trino service you just created (e.g., trino-msu9test).

Note: The service name must match Trino's cus_app_id.

This is a mandatory condition for Trino to work properly and for OpenMetadata to be able to test the connection successfully. If the basic Resource Policies are missing, when creating the Trino service in OM → Test Connection will fail.

Step 3: Create a Trino Service in OpenMetadata

1. Go to OpenMetadata > Settings > Services > Databases → click Add New Service.

2. Select Trino → click Next.

3. Fill in the service information:

Service Name (e.g., trino-tester).

Username, Password, Host, Port (pointing to the Trino cluster you just created on the portal).

4. Click Test Connection → if successful, click Save.

5. Go to the Ingestion tab of the Trino service → click Add Ingestion.

Fill in the Database/Schema/Table Filter Pattern.

Run ingestion.

6. Once ingestion succeeds, the Trino DB is displayed in Explore.

7. Go to Explore > Database Trino → assign a tag to a column (e.g., the tag Sensitive for the custkey column in the customer table).

Step 4: Create a Tag Service & Trino Service in Ranger

1. Go to Ranger dashboard > Service Manager > Tag tab → click Add New Service to create the Tag Service first (e.g., trino-msu9test-tag).

2. Go to Service Manager > Resource tab → edit Service Trino (e.g., trino-msu9test).

In the Trino service configuration → set the Select Tag Service field to trino-msu9test-tag.

3. Go to Settings > Users → click Add New User:

Create a user (e.g., usertest) with role = User.

The username must match the user already created in the Trino portal.

4. Go to Resource Policies → add the usertest user to the default policies

a. Check/Add the default policies:

• all – trinouser
• all - queryid

b. Add a new policy (policy-customer-access):

• Catalog = tpch
• Schema = sf1, information_schema
• Table = customer, columns, schemata, tables
• Column = custkey

note

information_schema, columns, schemata, tables → required for Trino to read metadata (show tables, describe, etc.).

customer → the business table you want to allow access to.

c. In Allow Conditions, add the user (e.g., usertest) → Permission = Select.

d. Save the policy.

Step 5: Configure Tag Sync on the Ranger Service

1. Go to Data Platform > Data Governance (Ranger) > Advanced > Tag Sync.

2. Check Enable Tag Sync.

3. Get the JWT Token from OpenMetadata:

Go to Settings > Bots → select the tagsync-bot bot → Credentials tab → copy the token.

Paste it into the JWT Token field.

4. In the Service mappings section, select:

OpenMetadata service = the Trino service you just created in OpenMetadata.

Ranger service = the Trino service you just created in Ranger.

At least 1 mapping is required, up to a maximum of 5 mappings.

5. Click Test Connection.

If successful → "Connection successful" is displayed, and the Save button becomes enabled.

If it fails → an error is displayed, and you cannot Save.

6. Once Test Connection succeeds, click Save to save the configuration.

Step 6: Go to Tag Policies → select the Sensitive tag → click Add New Policy:

1. Policy Name: allow-sensitive.

2. Allow Conditions: user = usertest, component = TRINO, check all permissions.

3. Save.

Step 7: Test access permissions using queries

Only usertest is granted access to the customer table; usertest has no permission to query the orders table

Case 1 – User is Allowed & has permission to query the custkey column

1. Use DataGrip to connect to Trino with the usertest user.

2. Run the query:

SELECT custkey FROM tpch.sf1.customer LIMIT 1;

3. Expected result: the table data is returned.

Case 2 – User is Allowed & has no permission to query the table

1. DataGrip connects to Trino with the usertest user.

2. Run the query:

SELECT * FROM tpch.sf1.customer LIMIT 1;

3. Expected result: the query is rejected with a no permission message.

Case 3 – User is Denied & has no permission to query the custkey column

1. Create another user (e.g., usertest2).

2. Assign the Personal tag to the custkey column.

3. In Tag Policies → create a Deny policy - Personal tag - for user usertest2.

4. Use DataGrip to connect to Trino with the usertest2 user.

5. Run the query:

SELECT custkey FROM tpch.sf1.customer LIMIT 1;

6. Expected result: the query is rejected with a no permission message.