Create Ranger

FPT Data Governance uses Ranger as a security management and access control solution for the Lakehouse solution for the Query engine (Trino). It provides centralized and granular access management, supporting control based on Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC).

To create a Data Governance, follow these steps:

Step 1: In the menu bar, select Data Platform > Workspace Management > Workspace name

Step 2: In the My service section, click Create > a popup appears, select New service, choose Ranger > Create

Step 3: In the Data Governance creation form, enter the Basic Information:

• Name (required): Service name

Note: The service name must be between 1 and 30 characters. It can contain lowercase letters a-z, uppercase letters A-Z, or numeric characters 0-9

• Description (optional): Description
• Version (required): select the version

Step 4: Click Next to go to the Node configuration screen

Enter the following information:

• Storage policy (required): select a Storage policy
• Type (required): select the resource configuration

Step 5. Click Next to go to the Additional properties screen

• Database (Database information used to store data for Data governance; you can use a Database already created on the FPT Database Engine service or any other Database of your own)
  • If the selected type is PostgreSQL:
    • Host name (required): hostname or IP address of Postgres
    • Port (required): connection port, default is 5432
    • Database name (required): database name
    • Username (required): account username for accessing Postgres
    • Password (required): password for accessing Postgres

After entering all the Database information, click Test connection to check the connection from the Workspace to the entered Database

Audit logs database: Enter the information

• Type (required): Opensearch or Elasticsearch

note

In the Configure Parameters of OpenSearch, the ssl_http parameter must be configured as False (HTTP) instead of the default value of True (HTTPS).

• Protocol (required): select http or https
• Host name (required): access address
• Port (required): connection port
• Username (required): account username
• Password (required): password
• Index (required): index

Click Test connection to check the connection from the Workspace to the Audit logs database

Usersync: (Automatically syncs users and groups from LDAP/AD into Ranger, enabling centralized permission management and reducing manual creation effort.)

• Enable Usersync (optional): default is unchecked.
  • Unchecked → Ranger does not sync with LDAP, and no additional fields are displayed.
  • Checked → opens the configuration sections below.
• When Enable Usersync = checked, enter the following information:
  • LDAP/AD URL (required): ldap://host:port or ldaps://host:port.
  • Password (required): password of the bind account.
  • Username (required): bind account with read permission, (e.g., cn=admin,dc=example,dc=com.)
  • User attribute (required): the attribute used as the username in Ranger (uid, sAMAccountName, cn, …).
  • User object class (required): the object type containing the user (person, inetOrgPerson, user, …).
  • User search base (required): root DN for the user search, e.g., ou=Users,dc=example,dc=com.
  • User search filter (optional): additional filter if needed, e.g., (&(objectClass=person)(department=IT)).
  • User group name attribute (optional): the attribute that stores the list of groups on the user (typically memberOf).

• Enable group config: select Enabled to sync groups.
  • Group member attribute (optional): attribute listing members (member, uniqueMember, memberUid).
  • Group name attribute (required when Enabled): attribute for the group name (cn).
  • Group object class (required when Enabled): group object type (groupOfNames, group, …).
  • Group search base (required when Enabled): root DN for the group search, e.g., ou=Groups,dc=example,dc=com.
  • Group search filter (optional): advanced filter, e.g., (&(objectClass=group)(cn=dev*)).

After filling in all the information, click Test connection to verify that Ranger connects to LDAP/AD successfully.

Single Sign On: If Single Sign On is not selected, Superset is initialized with Basic authentication. If Single Sign On is selected:

• Provider: FPT ID - Enter the following information:
  • Username: username
  • Email: FPT email address

• Provider: Google - Enter the following information:
  • Client ID: an ID string used to authenticate the client with Google
  • Client Secret: the password used to authenticate the client with Google
  • Email: email address

• Provider: Keycloak - Enter the following information:
  • Auth Provider name: Provider name
  • Realm: a management space in which all users, groups, roles, clients, and other objects are managed and secured independently
  • Auth server url: the base auth URL of the Keycloak server, used by clients to perform authentication
  • Client ID: an ID string used to authenticate the client with Keycloak
  • Client Secret: the password used to authenticate the client with Keycloak
  • Username: username in Keycloak
  • Email: email address in Keycloak

Custom Domain

• Purpose: Allows configuring a custom domain to access services.
  • For Public Workspace: Used to assign a domain and certificate without needing to enable/disable TLS (HTTPS is always available).
  • For Private Workspace: In addition to domain and certificate, you can optionally enable or disable TLS/SSL to decide whether to use HTTPS or HTTP.
• Workspace is Public
  • Custom domain: Check to enable a custom domain.
  • Domain: Enter the domain name (e.g., abc.local, jupyter.example.com).
  • Certificate name: Select from the list of certificates already imported in Certificate Manager.
  • Buttons:
    • Manage certificate: Opens the certificate management screen.
    • Validate: Checks that the certificate is valid for the domain.

note

For a Public Workspace, the TLS/SSL certificate option is not displayed — the system supports HTTPS by default.

• Workspace is Private
  • Custom domain: Check to enable a custom domain.
  • Domain: Enter the domain name.
  • TLS/SSL certificate: Check to enable HTTPS for services.
  • Certificate name: Select from the certificate list.
  • Buttons:
    • Manage certificate: Opens certificate management.
    • Validate: Checks the certificate.

note

If TLS/SSL certificate is unchecked, the service will run on HTTP and no certificate is required.

Step 6: Click Next Step to go to the Review & Create screen

Step 7. Review the entered information, then click Create to complete.

Data governance initialization is complete when the Worker Status is Succeeded and the Status of Ranger is Healthy (~10 minutes)