mneethiraj commented on code in PR #588:
URL: https://github.com/apache/ranger/pull/588#discussion_r2192680814
##########
agents-common/src/main/java/org/apache/ranger/plugin/policyevaluator/RangerDefaultPolicyEvaluator.java:
##########
@@ -613,8 +613,12 @@ protected void evaluatePolicyItems(RangerAccessRequest
request, MatchType matchT
if (getPolicyPriority() >= oldPriority &&
allowResult != null && (oneRequest.isAccessTypeAny() ||
RangerAccessRequestUtil.getIsAnyAccessInContext(oneRequest.getContext()))) {
accessTypeResults.put(accessType, allowResult);
} else {
- if (getPolicyPriority() > oldPriority &&
denyResult != null) {
- accessTypeResults.put(accessType,
denyResult);
+ if (getPolicyPriority() > oldPriority) {
+ if (allowResult != null) {
Review Comment:
@fateh288 - accessType _any is used to find the user has any permisssion on
the given resource. In this case, when the user is allowed for at least one
accessType (like select), policy evaluation must ignore all denies (like for
accessTypes insert/update/drop/..). Hope this helps.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
