CalvinKirs opened a new pull request, #67206:
URL: https://github.com/apache/doris/pull/67206
### What problem does this PR solve?
Issue Number: None
Related PR: None
Problem Summary:
`RangerAccessController` hardcoded the Doris uppercase `SELECT` access type
for row-filter and data-mask requests. Ranger-Hive defines this access type as
lowercase `select`, so its row-filter and data-mask policies were skipped even
though ordinary SELECT authorization succeeded.
This was reproduced against the unmodified `apache/doris:all-in-one-4.1.3`
image. The query was authorized but returned the unfiltered and unmasked rows:
```text
expected: [[2, NULL]]
actual: [[1, first], [2, second]]
```
This PR:
- delegates the select access-type mapping to each Ranger service;
- keeps Ranger-Doris on uppercase `SELECT`;
- uses lowercase `select` consistently for Ranger-Hive authorization, row
filters, and data masks;
- lets Ranger-Hive obtain its Ranger endpoint configuration from catalog
properties while preserving the legacy `ranger-<serviceName>-security.xml`
fallback;
- adds unit coverage and an end-to-end `ranger_p2` regression case with
lowercase access entries, row filtering, data masking, and a warmed-up policy
evaluator.
### Release note
Fix Ranger-Hive row filtering and data masking for lowercase `select`
policies.
### Check List (For Author)
- Test
- [x] Regression test
- [x] Unit Test
- [x] Manual test (add detailed scripts or steps below)
- [ ] No need to test or manual test. Explain why:
- [ ] This is a refactor/code format and no logic has been changed.
- [ ] Previous test can cover this change.
- [ ] No code files have been changed.
- [ ] Other reason
Test details:
- FE 60-module Maven reactor: `BUILD SUCCESS`.
- `RangerHiveAccessControllerTest`: 3 tests passed, 0 failures/errors/skips.
- Final targeted `test_ranger_hive_lowercase_access_type`: 1 suite passed
after rebasing onto the latest `master`.
- Full patched `ranger_p2`: 11 suites passed, 0 failed/fatal/skipped.
- Native Doris 4.1.3 A/B run: the new regression case failed with
unfiltered, unmasked results as expected.
- Behavior changed:
- [ ] No.
- [x] Yes. Ranger-Hive row-filter and data-mask policies now match
lowercase `select` access entries.
- Does this need documentation?
- [x] No.
- [ ] Yes.
### Check List (For Reviewer who merge this PR)
- [ ] Confirm the release note
- [ ] Confirm test cases
- [ ] Confirm document
- [ ] Add branch pick label
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
