Eoin McDonnell created RANGER-5730:
--------------------------------------
Summary: Improve nested role import to resolve in-file role
dependencies without creating users/groups
Key: RANGER-5730
URL: https://issues.apache.org/jira/browse/RANGER-5730
Project: Ranger
Issue Type: Improvement
Components: admin
Reporter: Eoin McDonnell
Assignee: Eoin McDonnell
When importing roles via RoleREST.importRolesFromFile with
createNonExistUserGroupRole=false, import can fail if a role references nested
(child) roles that have not been created yet in the same import run.
Example failure:
"Role with name: <roleName> does not exist"
Setting createNonExistUserGroupRole=true avoids the failure by creating missing
referenced roles, but the same flag also creates missing users and groups. That
is undesirable for customers who already sync large user/group sets (for
example during Unix to LDAP sync-source migration) and do not want Ranger to
create unsynced users/groups during role import.
Today there is no option to create missing roles only, and import processes
roles in file order without resolving nested-role dependencies within the
import payload.
Proposal:
1. Make importRolesFromFile dependency-aware (for example two-pass import):
first create/update roles, then apply nested role/user/group memberships once
referenced roles from the same file exist.
2. Keep createNonExistUserGroupRole behavior for missing users/groups/roles
that are not present in the import file.
3. Add tests for nested role import with createNonExistUserGroupRole=false when
all referenced roles are included in the same JSON file.
Primary code areas:
- security-admin/.../RoleREST.java (importRolesFromFile)
- security-admin/.../RoleRefUpdater.java
- security-admin/.../RoleDBStore.java
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
