This is an automated email from the ASF dual-hosted git repository.
dineshkumar-yadav pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ranger.git
The following commit(s) were added to refs/heads/master by this push:
new 421db18c0 RANGER-5729: Unable to import exported GDS policies via
Service Manager due to 403 Error (#1125)
421db18c0 is described below
commit 421db18c0aa5dce17114f62aaadbd381f219a617
Author: Sanket-Shelar <[email protected]>
AuthorDate: Mon Aug 10 11:55:33 2026 +0530
RANGER-5729: Unable to import exported GDS policies via Service Manager due
to 403 Error (#1125)
---
.../java/org/apache/ranger/rest/ServiceREST.java | 18 +++-
.../org/apache/ranger/rest/TestServiceREST.java | 105 +++++++++++++++++++++
2 files changed, 118 insertions(+), 5 deletions(-)
diff --git
a/security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
b/security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
index e75f1018c..94efefa3d 100644
--- a/security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
+++ b/security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
@@ -3492,6 +3492,12 @@ private int
createPolicesBasedOnPolicyMap(HttpServletRequest request, Map<String
RangerPolicy policy = entry.getValue();
if (policy != null) {
+ if (isGdsPolicy(policy)) {
+ LOG.warn("Skipping GDS policy '{}' during import - GDS
policies must be managed via GDS APIs", policy.getName());
+
+ continue;
+ }
+
if (!CollectionUtils.isEmpty(serviceNameList)) {
for (String service : serviceNameList) {
if (StringUtils.isNotEmpty(service.trim()) &&
StringUtils.isNotEmpty(policy.getService().trim())) {
@@ -3837,7 +3843,7 @@ private List<RangerPolicy>
getAllFilteredPolicyList(SearchFilter filter, HttpSer
if (!CollectionUtils.isEmpty(policyLists)) {
for (RangerPolicy policy : policyLists) {
- if (policy != null) {
+ if (policy != null && !isGdsPolicy(policy)) {
//set createTime & updateTime Time as null since exported
policies dont need this
policy.setCreateTime(null);
policy.setUpdateTime(null);
@@ -3845,16 +3851,18 @@ private List<RangerPolicy>
getAllFilteredPolicyList(SearchFilter filter, HttpSer
orderedPolicies.put(policy.getId(), policy);
}
}
- if (!orderedPolicies.isEmpty()) {
- policyLists.clear();
- policyLists.addAll(orderedPolicies.values());
- }
+ policyLists.clear();
+ policyLists.addAll(orderedPolicies.values());
}
return policyLists;
}
+ private boolean isGdsPolicy(RangerPolicy policy) {
+ return EMBEDDED_SERVICEDEF_GDS_NAME.equals(policy.getServiceType());
+ }
+
private void deletePoliciesProvidedInServiceMap(List<String>
sourceServices, List<String> destinationServices, String zoneName) throws
Exception {
int totalDeletedPolicies = 0;
diff --git
a/security-admin/src/test/java/org/apache/ranger/rest/TestServiceREST.java
b/security-admin/src/test/java/org/apache/ranger/rest/TestServiceREST.java
index 4f26b13f3..821d1a2e4 100644
--- a/security-admin/src/test/java/org/apache/ranger/rest/TestServiceREST.java
+++ b/security-admin/src/test/java/org/apache/ranger/rest/TestServiceREST.java
@@ -4700,4 +4700,109 @@ public void
testUpdateService_BlankNameWithIdInPayload() throws Exception {
"serviceDef Id mismatch or service name not provided",
true);
}
+
+ @Test
+ public void testIsGdsPolicy_ByServiceType() throws Exception {
+ Method m = ServiceREST.class.getDeclaredMethod("isGdsPolicy",
RangerPolicy.class);
+ m.setAccessible(true);
+ RangerPolicy policy = new RangerPolicy();
+
policy.setServiceType(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_GDS_NAME);
+
+ Assertions.assertTrue((Boolean) m.invoke(serviceREST, policy));
+ }
+
+ @Test
+ public void testIsGdsPolicy_ByServiceNameOnlyReturnsFalse() throws
Exception {
+ Method m = ServiceREST.class.getDeclaredMethod("isGdsPolicy",
RangerPolicy.class);
+ m.setAccessible(true);
+ RangerPolicy policy = new RangerPolicy();
+ policy.setService(ServiceDBStore.GDS_SERVICE_NAME);
+
+ Assertions.assertFalse((Boolean) m.invoke(serviceREST, policy));
+ }
+
+ @Test
+ public void testIsGdsPolicy_NonGdsPolicy() throws Exception {
+ Method m = ServiceREST.class.getDeclaredMethod("isGdsPolicy",
RangerPolicy.class);
+ m.setAccessible(true);
+ RangerPolicy policy = rangerPolicy();
+ policy.setServiceType("hive");
+ policy.setService("dev_hive");
+
+ Assertions.assertFalse((Boolean) m.invoke(serviceREST, policy));
+ }
+
+ @Test
+ public void testGetAllFilteredPolicyList_ExcludesGdsPolicies() throws
Exception {
+ ServiceREST spy = Mockito.spy(serviceREST);
+ HttpServletRequest request = Mockito.mock(HttpServletRequest.class);
+ SearchFilter filter = new SearchFilter();
+
+ RangerPolicy hivePolicy = new RangerPolicy();
+ hivePolicy.setId(1L);
+ hivePolicy.setService("dev_hive");
+ hivePolicy.setServiceType("hive");
+ hivePolicy.setName("hive-policy");
+
+ RangerPolicy gdsPolicy = new RangerPolicy();
+ gdsPolicy.setId(2L);
+ gdsPolicy.setService(ServiceDBStore.GDS_SERVICE_NAME);
+
gdsPolicy.setServiceType(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_GDS_NAME);
+ gdsPolicy.setName("DATASET: dataset_test1");
+
+ Mockito.doReturn(new ArrayList<>(Arrays.asList(hivePolicy,
gdsPolicy))).when(spy).getPolicies(Mockito.any(SearchFilter.class));
+
+ Method m =
ServiceREST.class.getDeclaredMethod("getAllFilteredPolicyList",
SearchFilter.class, HttpServletRequest.class, List.class);
+ m.setAccessible(true);
+ @SuppressWarnings("unchecked")
+ List<RangerPolicy> out = (List<RangerPolicy>) m.invoke(spy, filter,
request, new ArrayList<>());
+
+ Assertions.assertNotNull(out);
+ Assertions.assertEquals(1, out.size());
+ Assertions.assertEquals(hivePolicy.getId(), out.get(0).getId());
+ }
+
+ @Test
+ public void
testGetAllFilteredPolicyList_ExcludesOnlyGdsPoliciesReturnsEmpty() throws
Exception {
+ ServiceREST spy = Mockito.spy(serviceREST);
+ HttpServletRequest request = Mockito.mock(HttpServletRequest.class);
+ SearchFilter filter = new SearchFilter();
+
+ RangerPolicy gdsPolicy = new RangerPolicy();
+ gdsPolicy.setId(2L);
+ gdsPolicy.setService(ServiceDBStore.GDS_SERVICE_NAME);
+
gdsPolicy.setServiceType(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_GDS_NAME);
+ gdsPolicy.setName("DATASET: dataset_test1");
+
+ Mockito.doReturn(new
ArrayList<>(Collections.singletonList(gdsPolicy))).when(spy).getPolicies(Mockito.any(SearchFilter.class));
+
+ Method m =
ServiceREST.class.getDeclaredMethod("getAllFilteredPolicyList",
SearchFilter.class, HttpServletRequest.class, List.class);
+ m.setAccessible(true);
+ @SuppressWarnings("unchecked")
+ List<RangerPolicy> out = (List<RangerPolicy>) m.invoke(spy, filter,
request, new ArrayList<>());
+
+ Assertions.assertNotNull(out);
+ Assertions.assertTrue(out.isEmpty());
+ }
+
+ @Test
+ public void testCreatePolicesBasedOnPolicyMap_SkipsGdsPolicy() throws
Exception {
+ ServiceREST spy = Mockito.spy(serviceREST);
+ Method m =
ServiceREST.class.getDeclaredMethod("createPolicesBasedOnPolicyMap",
HttpServletRequest.class, Map.class, List.class, boolean.class, int.class);
+ m.setAccessible(true);
+ HttpServletRequest request = Mockito.mock(HttpServletRequest.class);
+
+ RangerPolicy gdsPolicy = new RangerPolicy();
+ gdsPolicy.setService(ServiceDBStore.GDS_SERVICE_NAME);
+
gdsPolicy.setServiceType(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_GDS_NAME);
+ gdsPolicy.setName("DATASET: dataset_test1");
+
+ Map<String, RangerPolicy> map = new HashMap<>();
+ map.put("gds", gdsPolicy);
+
+ int ret = (int) m.invoke(spy, request, map, Collections.emptyList(),
false, 0);
+
+ Assertions.assertEquals(0, ret);
+ Mockito.verify(spy,
Mockito.never()).createPolicy(Mockito.any(RangerPolicy.class),
Mockito.eq(request));
+ }
}
