apache · shfshihuafeng · Jul 15, 2026
diff --git a/distribution/pom.xml b/distribution/pom.xml
@@ -73,6 +73,23 @@
       <artifactId>drill-common</artifactId>
       <version>${project.version}</version>
     </dependency>
+    <dependency>
+      <groupId>org.apache.drill</groupId>
+      <artifactId>drill-ranger-plugin</artifactId>
+      <version>${project.version}</version>
+    </dependency>
+    <!--
+      Ranger Admin service plugin (REST-based, JDK 8 bytecode, no Drill deps).
+      Deployed into Ranger Admin's WEB-INF/lib. No shade/fat jar needed:
+      the plugin uses only HttpURLConnection (JDK-standard) and Jackson
+      (provided by Ranger Admin).
+    -->
+    <dependency>
+      <groupId>org.apache.drill</groupId>
+      <artifactId>ranger-drill-service</artifactId>
+      <version>${project.version}</version>
+      <type>jar</type>
+    </dependency>
     <dependency>
       <groupId>org.apache.drill</groupId>
       <artifactId>drill-yarn</artifactId>

diff --git a/distribution/src/assemble/component.xml b/distribution/src/assemble/component.xml
@@ -65,6 +65,7 @@
         <include>org.apache.drill:drill-common:jar</include>
         <include>org.apache.drill:drill-logical:jar</include>
         <include>org.apache.drill:drill-protocol:jar</include>
+        <include>org.apache.drill:drill-ranger-plugin:jar</include>
         <include>org.apache.drill.exec:drill-java-exec:jar</include>
         <include>org.apache.drill.exec:drill-jdbc:jar</include>
         <include>org.apache.drill.exec:drill-rpc:jar</include>
@@ -98,6 +99,21 @@
       <useProjectArtifact>false</useProjectArtifact>
     </dependencySet>
 
+    <!--
+      Ranger Admin service plugin (self-contained fat jar with drill-jdbc
+      shaded + relocated). Kept in its own directory so it never lands on the
+      Drillbit classpath. Users copy this jar into Ranger Admin's
+      WEB-INF/classes/lib to enable Test Connection and resource autocomplete
+      in the Ranger policy editor.
+    -->
+    <dependencySet>
+      <includes>
+        <include>org.apache.drill:ranger-drill-service:jar</include>
+      </includes>
+      <outputDirectory>jars/ranger-service</outputDirectory>
+      <useProjectArtifact>false</useProjectArtifact>
+    </dependencySet>
+
     <dependencySet>
       <outputDirectory>jars/classb</outputDirectory>
       <unpack>false</unpack>
@@ -220,6 +236,11 @@
       <directory>${project.build.directory}/winutils</directory>
       <outputDirectory>winutils/bin</outputDirectory>
     </fileSet>
+    <fileSet>
+      <directory>src/main/resources/ranger</directory>
+      <outputDirectory>conf/ranger</outputDirectory>
+      <fileMode>0640</fileMode>
+    </fileSet>
   </fileSets>
 
   <files>

diff --git a/distribution/src/main/resources/drill-config.sh b/distribution/src/main/resources/drill-config.sh
@@ -365,6 +365,11 @@ export DRILLBIT_LOG_PATH="${DRILL_LOG_PREFIX}.log"
 # Add Drill conf folder at the beginning of the classpath
 CP="$DRILL_CONF_DIR"
 
+# Add Ranger config directory if it exists (for ranger-drill-security.xml etc.)
+if [ -d "$DRILL_CONF_DIR/ranger" ]; then
+  CP="$CP:$DRILL_CONF_DIR/ranger"
+fi
+
 # If both user and YARN-provided Java lib paths exist,
 # combine them.
 

diff --git a/distribution/src/main/resources/ranger/ranger-drill-audit.xml b/distribution/src/main/resources/ranger/ranger-drill-audit.xml
@@ -0,0 +1,49 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xsl" href="configuration.xsl"?>
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one or more
+  contributor license agreements.  See the NOTICE file distributed with
+  this work for additional information regarding copyright ownership.
+  The ASF licenses this file to You under the Apache License, Version 2.0
+  (the "License"); you may not use this file except in compliance with
+  the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+-->
+<configuration>
+  <!-- Audit log destination. Set to Solr or HDFS for persistent audit storage.
+       If not configured, RangerDefaultAuditHandler logs to the Drillbit log. -->
+  <property>
+    <name>xasecure.audit.is.audit.to.solr</name>
+    <value>false</value>
+  </property>
+  <property>
+    <name>xasecure.audit.solr.url</name>
+    <value>http://ranger-admin-host:6083/solr/ranger_audits</value>
+  </property>
+
+  <property>
+    <name>xasecure.audit.is.audit.to.hdfs</name>
+    <value>false</value>
+  </property>
+  <property>
+    <name>xasecure.audit.hdfs.config.directory</name>
+    <value>hdfs://namenode:8020/ranger/audit</value>
+  </property>
+  <property>
+    <name>xasecure.audit.hdfs.config.file</name>
+    <value>/etc/hadoop/conf/core-site.xml</value>
+  </property>
+
+  <!-- Audit to log4j as fallback (always enabled) -->
+  <property>
+    <name>xasecure.audit.is.audit.to.log4j</name>
+    <value>true</value>
+  </property>
+</configuration>
diff --git a/distribution/src/main/resources/ranger/ranger-drill-security.xml b/distribution/src/main/resources/ranger/ranger-drill-security.xml
@@ -0,0 +1,51 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xsl" href="configuration.xsl"?>
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one or more
+  contributor license agreements.  See the NOTICE file distributed with
+  this work for additional information regarding copyright ownership.
+  The ASF licenses this file to You under the Apache License, Version 2.0
+  (the "License"); you may not use this file except in compliance with
+  the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+-->
+<configuration>
+  <!-- Ranger Admin REST URL. Update to point to your Ranger Admin instance. -->
+  <property>
+    <name>ranger.plugin.drill.policy.rest.url</name>
+    <value>http://ranger-admin-host:6080</value>
+  </property>
+
+  <!-- Ranger service instance name. Must match a service created in Ranger Admin
+       with service type "drill". Should match drill.exec.security.ranger.service.name
+       in drill-override.conf. -->
+  <property>
+    <name>ranger.plugin.drill.service.name</name>
+    <value>drill</value>
+  </property>
+
+  <!-- Policy source implementation -->
+  <property>
+    <name>ranger.plugin.drill.policy.source.impl</name>
+    <value>org.apache.ranger.admin.client.RangerAdminRESTClient</value>
+  </property>
+
+  <!-- Policy polling interval in milliseconds -->
+  <property>
+    <name>ranger.plugin.drill.policy.pollIntervalMs</name>
+    <value>30000</value>
+  </property>
+
+  <!-- Local policy cache directory -->
+  <property>
+    <name>ranger.plugin.drill.policy.cache.dir</name>
+    <value>/tmp/ranger/drill/policy</value>
+  </property>
+</configuration>
diff --git a/distribution/src/main/resources/ranger/ranger-servicedef-drill.json b/distribution/src/main/resources/ranger/ranger-servicedef-drill.json
@@ -0,0 +1,163 @@
+{
+  "name": "drill",
+  "label": "Apache Drill",
+  "description": "Apache Drill distributed SQL query engine",
+  "guid": "d8b1c0a2-7e3f-4b2a-9c1d-0a1b2c3d4e5f",
+  "implClass": "org.apache.ranger.services.drill.RangerServiceDrill",
+  "version": 1,
+  "resources": [
+    {
+      "itemId": 1,
+      "name": "datasource",
+      "label": "Data Source",
+      "description": "Drill storage plugin name (e.g. dfs, hive, mongo)",
+      "level": 10,
+      "parent": "",
+      "mandatory": true,
+      "lookupSupported": true,
+      "recursiveSupported": false,
+      "excludesSupported": false,
+      "matcher": "org.apache.ranger.plugin.resourcematcher.RangerDefaultResourceMatcher",
+      "matcherOptions": {
+        "wildCard": "false",
+        "ignoreCase": "false"
+      },
+      "validationRegEx": "",
+      "uiPageSize": "",
+      "accessTypeRestrictions": []
+    },
+    {
+      "itemId": 2,
+      "name": "schema",
+      "label": "Schema",
+      "description": "Schema path within the data source (e.g. tmp, default)",
+      "level": 20,
+      "parent": "datasource",
+      "mandatory": true,
+      "lookupSupported": true,
+      "recursiveSupported": true,
+      "excludesSupported": true,
+      "matcher": "org.apache.ranger.plugin.resourcematcher.RangerDefaultResourceMatcher",
+      "matcherOptions": {
+        "wildCard": "true",
+        "ignoreCase": "false"
+      },
+      "validationRegEx": "",
+      "uiPageSize": "",
+      "accessTypeRestrictions": []
+    },
+    {
+      "itemId": 3,
+      "name": "table",
+      "label": "Table",
+      "description": "Table name within the schema",
+      "level": 30,
+      "parent": "schema",
+      "mandatory": true,
+      "lookupSupported": true,
+      "recursiveSupported": true,
+      "excludesSupported": true,
+      "matcher": "org.apache.ranger.plugin.resourcematcher.RangerDefaultResourceMatcher",
+      "matcherOptions": {
+        "wildCard": "true",
+        "ignoreCase": "false"
+      },
+      "validationRegEx": "",
+      "uiPageSize": "",
+      "accessTypeRestrictions": []
+    },
+    {
+      "itemId": 4,
+      "name": "column",
+      "label": "Column",
+      "description": "Column name within the table",
+      "level": 40,
+      "parent": "table",
+      "mandatory": false,
+      "lookupSupported": true,
+      "recursiveSupported": true,
+      "excludesSupported": true,
+      "matcher": "org.apache.ranger.plugin.resourcematcher.RangerDefaultResourceMatcher",
+      "matcherOptions": {
+        "wildCard": "true",
+        "ignoreCase": "false"
+      },
+      "validationRegEx": "",
+      "uiPageSize": "",
+      "accessTypeRestrictions": []
+    }
+  ],
+  "accessTypes": [
+    {
+      "itemId": 1,
+      "name": "SELECT",
+      "label": "Select",
+      "impliedGrants": ["SHOW", "USE"]
+    },
+    {
+      "itemId": 2,
+      "name": "CREATE",
+      "label": "Create"
+    },
+    {
+      "itemId": 3,
+      "name": "INSERT",
+      "label": "Insert"
+    },
+    {
+      "itemId": 4,
+      "name": "DROP",
+      "label": "Drop"
+    },
+    {
+      "itemId": 5,
+      "name": "SHOW",
+      "label": "Show",
+      "impliedGrants": []
+    },
+    {
+      "itemId": 6,
+      "name": "USE",
+      "label": "Use",
+      "impliedGrants": []
+    },
+    {
+      "itemId": 7,
+      "name": "DELETE",
+      "label": "Delete"
+    }
+  ],
+  "serviceConfigOptions": [
+    {
+      "itemId": 1,
+      "name": "username",
+      "label": "Username",
+      "description": "Drill user name for policy lookup connection",
+      "type": "string",
+      "mandatory": true,
+      "defaultValue": "",
+      "validationRegEx": ""
+    },
+    {
+      "itemId": 2,
+      "name": "password",
+      "label": "Password",
+      "description": "Drill user password",
+      "type": "password",
+      "mandatory": false,
+      "defaultValue": ""
+    },
+    {
+      "itemId": 3,
+      "name": "drill.connection.url",
+      "label": "Drill REST URL",
+      "description": "Drill REST API endpoint for resource lookup (e.g. http://drillbit-host:8047)",
+      "type": "string",
+      "mandatory": true,
+      "defaultValue": "http://localhost:8047"
+    }
+  ],
+  "policyConditions": [],
+  "contextEnrichers": [],
+  "enums": []
+}
diff --git a/docs/dev/DevDocs.md b/docs/dev/DevDocs.md
@@ -27,3 +27,10 @@ For information about the Jetty 12 upgrade, known limitations, and developer gui
 ## Materialized Views
 
 For information about materialized view support, including SQL syntax, query rewriting, and metastore integration, see [MaterializedViews.md](MaterializedViews.md)
+
+For information on the Jetty 12 upgrade, known limitations, and developer guidelines see [Jetty12Migration.md](Jetty12Migration.md)
+
+## Ranger Authorization
+
+For information on developing and configuring Apache Ranger column-level authorization for Drill see [RangerAuthorization.md](RangerAuthorization.md)
+