Apache Ranger Resource Trie

Apache Ranger

This article is explaining about the Resource trie used in *Apache Ranger* open source project for fine grained evaluation of access control policies for providing the authorization to multiple big data components.

1 .There is a separate class in Ranger code for Trie data structure for Resources called *RangerResourceTrie.java*

*RangerResourceTrie.java class contains [TrieNode](https://github.com/apache/ranger/blob/master/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerResourceTrie.java#L70)* which contains Set of Evaluators which contains resource and Policy information.

There are different policy evaluators in Ranger in order to check and compare the access request with current policies and policy Items like

RangerDefaultPolicyEvaluator, RangerDefaultPolicyItemEvaluator,RangerOptimizedPolicyEvaluator,RangerDataMaskPolicyItemEvaluator
,RangerRowFilterPolicyItemEvaluator

2.RangerResourceTrie is used in RangerPolicyRepository where it is stored as,

 private final Map<String, RangerResourceTrie> policyResourceTrie;

*https://github.com/apache/ranger/blob/master/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyRepository.java#L89*

Along with RangerResourceTrie, RangerPolicyRepository also stores policies, service Name, policy Version, policy Evaluators, service Definition etc.

3. This RangerResourceTrie is used during policy evaluation for access, in RangerPolicyRepository -> getLikelyMatchAccessPolicyEvaluators as mentioned in step 5.1.3 Apache Ranger#Howdoestherangerauthorizetherequesttoaresource

I Hope this article helps you in some way to understand Resource trie data structure in Apache Ranger.