# Migrating Ranger policies

Cloudera Migration Assistant (CMA) can scan Apache Ranger policies on a source cluster, display them in the Discovery browser, and show policy indicators on HDFS and Hive resources to help you understand authorization coverage before migration.

!!! warning "Technical preview"
    This feature is in technical preview and may change in a future release. It is not recommended for production use.

## About this task

Ranger policy scanning discovers all access, masking, and row-filter policies defined on the source cluster's Ranger Admin instance. After scanning, CMA displays the policies grouped by Ranger service (for example, HDFS, Hive, HBase, Knox) and enriches the HDFS and Hive Discovery browsers with indicators showing which resources are covered by Ranger policies.

You can organize scanned policies into collections to plan phased migrations.

!!! note
    Ranger policy scanning requires the `cma.ranger-policy-migration-enabled` feature flag to be enabled. Contact your CMA administrator to enable this flag in the **Settings** page before proceeding.

## Before you begin

- Ensure that CMA is set up correctly using the steps in [Deploying Cloudera Migration Assistant](../administrator/cma-server-setup.md).
- Ensure that the source cluster is registered and visible on the **Clusters** page. See [Registering clusters](cma-cluster-registration.md).
- Ensure that the source cluster runs Cloudera Base with the Ranger service deployed.
- Ensure that the source cluster is Kerberized. In the current technical preview, only Kerberos SPNEGO authentication is supported for Ranger policy scanning.
- Ensure that the `cma.ranger-policy-migration-enabled` feature flag is enabled.

!!! important
    The scanning user must have sufficient Ranger Admin privileges to read policies. Only policies visible to the authenticated user are returned during the scan.

## Step 1 — Scan Ranger policies

1. On the **Clusters** page, click the source cluster you want to scan.
2. Click **Start Scanning** to open the **Scan Settings**.
3. Select **Ranger policy scan**.
4. Click **Scan selected**.

    You are redirected to the scanning progress view where you can monitor the scan status.

!!! note
    The scan discovers all Ranger services on the cluster, fetches their policies, and streams them to the CMA Master. The scan also collects Ranger users, groups, and roles for reference.

## Step 2 — Browse Ranger policies in Discovery

After the scan completes, the scanned policies are available in the Discovery browser.

1. Click the **Discovery** tab on the cluster page.
2. Select **Ranger Policies** in the browser navigation.

    The browser displays a tree hierarchy:

    - **Root** — lists all discovered Ranger services
    - **Service** — shows the service name, service type, and policy count
    - **Policy** — individual policy details displayed in a data table

    ![Ranger Discovery browser showing discovered services](../images/cma-ranger-discovery-browser-services.png)

3. Expand a service node to view its policies.

    ![Ranger Discovery browser showing policies for a service](../images/cma-ranger-discovery-browser-policies.png)

### Policy data table columns

The following columns are displayed for each policy:

| Column | Description |
|--------|-------------|
| **Name** | The policy name as defined in Ranger |
| **Service Type** | The Ranger service type (for example, HDFS, Hive, HBase) |
| **Policy Type** | The policy type: access, masking, or row-filter |
| **Enabled** | Whether the policy is enabled (Yes or No) |
| **Resources** | The resource paths, databases, or tables the policy applies to, including recursive and exclude flags |
| **Permissions** | The access permissions granted by the policy |
| **Allow Users** | Users granted access by the policy |
| **Allow Groups** | Groups granted access by the policy |
| **Collections** | Collection labels assigned to the policy |

Additional columns (hidden by default) include Policy ID, Allow Roles, Deny Users, Deny Groups, Deny Roles, Delegate Admin, Conditions, Ranger Labels, and Description. Click the column settings to show or hide columns.

## Step 3 — Review Ranger policy indicators

After a Ranger policy scan, the HDFS and Hive Discovery browsers display policy indicators next to resources that are covered by Ranger policies.

1. Navigate to the **HDFS Locations** or **Hive Tables** browser in the **Discovery** tab.
2. Look for the **Ranger Policies** column. A Ranger icon appears next to resources that have matching policies.
3. Hover over or click the icon to see the names of matching policies.

    ![Ranger policy indicator on HDFS location](../images/cma-ranger-indicator-hdfs.png)

CMA matches policies to resources using three methods:

- **Exact match** — the policy resource value matches the HDFS path or Hive table exactly
- **Recursive match** — a policy with the recursive flag enabled covers the resource and all its descendants
- **Wildcard match** — policies with wildcard patterns (`*` or `?`) are evaluated against the resource path

## Step 4 — Organize policies into collections

You can assign scanned Ranger policies to collections to group them for organized migration planning.

1. In the **Ranger Policies** browser, select the policies you want to group.
2. Click **Add to collection** to assign the **Default** label.
3. To create a custom collection, click the **+** icon next to **Collections**, provide a label name and color, and click **Create**.

Use the collection filter to narrow the policy list to a specific collection.

## Results

The Ranger policies on the source cluster are scanned and displayed in the Discovery browser. HDFS and Hive resources show Ranger policy indicators, giving you visibility into the authorization coverage of your data assets.

## What to do next

Organize the scanned policies into collections and create a migration plan to prepare for migrating Ranger policies to the destination cluster.

## Related information

- [Scanning clusters](cma-scanning.md)
- [Creating collections](cma-collections.md)
- [Registering clusters](cma-cluster-registration.md)
