naayifmuhammad opened a new pull request, #68203:
URL: https://github.com/apache/doris/pull/68203
title:
[fix](ranger) Document and hint Ranger UserStore group evaluation
### What problem does this PR solve?
Issue Number: None
Related PR: None
Problem Summary:
Ranger group-based policies, row-level filters, and column masks on the
internal catalog are never applied because
`RangerDorisAccessController.createRequest()` builds requests without
`userGroups`.
Instead of manually injecting groups into `createRequest()` (which would
alter policy evaluation for existing deployments), this PR delegates group
evaluation to Ranger's native `RangerDefaultRequestProcessor.preProcess()`.
Key modifications:
- **`RangerDorisAccessController.java`**: Documents why `userGroups` are
omitted in `createRequest()` to maintain backward compatibility.
- **`RangerDorisPlugin.java`**: Adds an `INFO` log on startup to hint
operators to set `ranger.plugin.doris.use.rangerGroups=true` in
`ranger-doris-security.xml` if they wish to enable group evaluation.
- **`RangerTest.java`**: Adds `testRequestDoesNotCarryRolesOrGroups` to lock
in the backward-compatible default behavior.
### Release note
Operators who want Ranger group, row-filter, and column-mask policies to
apply must set
`<property><name>ranger.plugin.doris.use.rangerGroups</name><value>true</value></property>`
in `ranger-doris-security.xml` and restart the FE. Default behavior remains
user-only evaluation.
### Check List (For Author)
- Test
- [ ] Regression test
- [x] Unit Test
- [ ] Manual test (add detailed scripts or steps below)
- [ ] No need to test or manual test. Explain why:
- Behavior changed:
- [ ] No.
- [x] Yes. Operators can now evaluate Ranger group policies by setting
`ranger.plugin.doris.use.rangerGroups=true`. Default remains unchanged.
- Does this need documentation?
- [x] No.
- [ ] Yes.
### Check List (For Reviewer who merge this PR)
- [ ] Confirm the release note
- [ ] Confirm test cases
- [ ] Confirm document
- [ ] Add branch pick label
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
