Title
Page icon
Create new category
Edit page index title
Edit category
Edit link
Create Ranger ABFS Policies
After you configure the Ranger ABFS service, create policies based on your access requirements.
When you create or modify a policy, Ranger synchronizes the corresponding permissions with the ADLS POSIX ACLs.
Access Mapping
ADLS permissions have different meanings for directories and files. The Ranger ABFS plugin maps Ranger access types to ADLS POSIX permissions as follows:
Ranger Access | Directory ACL | File ACL | Description |
|---|---|---|---|
|
|
| Reads and traverses directories and reads file contents. |
|
| No named entry | Lists and traverses directories without providing file-content access. |
|
|
| Creates or updates child objects and writes or appends files. |
|
| No named entry | Deletes or renames child objects through directory permissions. |
When a directory receives any permission, Ranger includes execute (x) permission so that the directory can be traversed.
For each configured principal, Ranger performs the following actions:
Writes an access ACL to matching files and directories.
Writes a default ACL only to directories when default inheritance is enabled.
Adds traverse-only (
--x) access to ancestor directories so that the target path is accessible.
Ancestor traverse entries are add-only. Ranger does not automatically remove these entries when you delete a policy because removing an ancestor entry might affect access required by other policies.
Ranger adds, updates, or removes only Ranger-managed ACL entries. Manually configured ACL entries for other principals are preserved.