[
https://issues.apache.org/jira/browse/RANGER-5730?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Eoin McDonnell updated RANGER-5730:
-----------------------------------
Description:
When importing roles via RoleREST.importRolesFromFile with
createNonExistUserGroupRole=false, import can fail if a role references nested
(child) roles that have not been created yet in the same import run.
Example failure:
"Role with name: <roleName> does not exist"
Setting createNonExistUserGroupRole=true avoids the failure by creating missing
referenced roles, but the same flag also creates missing users and groups. That
is undesirable for customers who already sync large user/group sets (for
example during Unix to LDAP sync-source migration) and do not want Ranger to
create unsynced users/groups during role import.
Today there is no option to create missing roles only, and import processes
roles in file order without resolving nested-role dependencies within the
import payload.
Proposal:
1. For role import (importRolesFromFile), restrict
createNonExistUserGroupRole=true
so it creates missing nested roles only; do not create missing users or
groups.
2. (Optional) Make import dependency-aware / two-pass so nested roles present
in the
same import file succeed even when createNonExistUserGroupRole=false.
3. Add tests covering nested role import without creating users/groups.
Primary code areas:
- security-admin/.../RoleREST.java (importRolesFromFile)
- security-admin/.../RoleRefUpdater.java
- security-admin/.../RoleDBStore.java
was:
When importing roles via RoleREST.importRolesFromFile with
createNonExistUserGroupRole=false, import can fail if a role references nested
(child) roles that have not been created yet in the same import run.
Example failure:
"Role with name: <roleName> does not exist"
Setting createNonExistUserGroupRole=true avoids the failure by creating missing
referenced roles, but the same flag also creates missing users and groups. That
is undesirable for customers who already sync large user/group sets (for
example during Unix to LDAP sync-source migration) and do not want Ranger to
create unsynced users/groups during role import.
Today there is no option to create missing roles only, and import processes
roles in file order without resolving nested-role dependencies within the
import payload.
Proposal:
1. Make importRolesFromFile dependency-aware (for example two-pass import):
first create/update roles, then apply nested role/user/group memberships once
referenced roles from the same file exist.
2. Keep createNonExistUserGroupRole behavior for missing users/groups/roles
that are not present in the import file.
3. Add tests for nested role import with createNonExistUserGroupRole=false when
all referenced roles are included in the same JSON file.
Primary code areas:
- security-admin/.../RoleREST.java (importRolesFromFile)
- security-admin/.../RoleRefUpdater.java
- security-admin/.../RoleDBStore.java
> Improve nested role import to resolve in-file role dependencies without
> creating users/groups
> ---------------------------------------------------------------------------------------------
>
> Key: RANGER-5730
> URL: https://issues.apache.org/jira/browse/RANGER-5730
> Project: Ranger
> Issue Type: Improvement
> Components: admin
> Reporter: Eoin McDonnell
> Assignee: Eoin McDonnell
> Priority: Major
>
> When importing roles via RoleREST.importRolesFromFile with
> createNonExistUserGroupRole=false, import can fail if a role references
> nested (child) roles that have not been created yet in the same import run.
> Example failure:
> "Role with name: <roleName> does not exist"
> Setting createNonExistUserGroupRole=true avoids the failure by creating
> missing referenced roles, but the same flag also creates missing users and
> groups. That is undesirable for customers who already sync large user/group
> sets (for example during Unix to LDAP sync-source migration) and do not want
> Ranger to create unsynced users/groups during role import.
> Today there is no option to create missing roles only, and import processes
> roles in file order without resolving nested-role dependencies within the
> import payload.
> Proposal:
> 1. For role import (importRolesFromFile), restrict
> createNonExistUserGroupRole=true
> so it creates missing nested roles only; do not create missing users or
> groups.
> 2. (Optional) Make import dependency-aware / two-pass so nested roles present
> in the
> same import file succeed even when createNonExistUserGroupRole=false.
> 3. Add tests covering nested role import without creating users/groups.
> Primary code areas:
> - security-admin/.../RoleREST.java (importRolesFromFile)
> - security-admin/.../RoleRefUpdater.java
> - security-admin/.../RoleDBStore.java
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
