[
https://issues.apache.org/jira/browse/RANGER-5726?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Fang-Yu Rao updated RANGER-5726:
--------------------------------
Fix Version/s: 2.9.0
(was: 3.0.0)
> Ranger server returns an incorrect error message when an admin tries to
> revoke a non-existing role from a user
> --------------------------------------------------------------------------------------------------------------
>
> Key: RANGER-5726
> URL: https://issues.apache.org/jira/browse/RANGER-5726
> Project: Ranger
> Issue Type: Bug
> Components: Ranger
> Reporter: Fang-Yu Rao
> Assignee: Akash Gupta
> Priority: Major
> Fix For: 2.9.0
>
>
> We found the Ranger server would return an incorrect error message when an
> admin tries to grant a non-existing role to a user. In what follows I provide
> the steps to reproduce the issue in a beeline instance connected to a version
> of Hive Server2.
> {code}
> # This verifies the requesting user is allowed to create a role 'role_100'.
> 0: jdbc:hive2://ccycloud-1.cdpd102205p01d06.r> create role role_100;
> INFO : Compiling
> command(queryId=hive_20260716191507_8f9415f3-5035-4d50-8029-ae5f8dee3ecb):
> create role role_100
> INFO : Semantic Analysis Completed (retrial = false)
> INFO : Created Hive schema: Schema(fieldSchemas:null, properties:null)
> INFO : Completed compiling
> command(queryId=hive_20260716191507_8f9415f3-5035-4d50-8029-ae5f8dee3ecb);
> Time taken: 0.03 seconds
> INFO : Executing
> command(queryId=hive_20260716191507_8f9415f3-5035-4d50-8029-ae5f8dee3ecb):
> create role role_100
> INFO : Starting task [Stage-0:DDL] in serial mode
> INFO : Completed executing
> command(queryId=hive_20260716191507_8f9415f3-5035-4d50-8029-ae5f8dee3ecb);
> Time taken: 0.037 seconds
> INFO : OK
> No rows affected (0.083 seconds)
> # # This verifies the role 'role_100' is dropped.
> 0: jdbc:hive2://ccycloud-1.cdpd102205p01d06.r> drop role role_100;
> INFO : Compiling
> command(queryId=hive_20260716191832_75c3783e-3e19-476d-a293-fd513629ddea):
> drop role role_100
> INFO : Semantic Analysis Completed (retrial = false)
> INFO : Created Hive schema: Schema(fieldSchemas:null, properties:null)
> INFO : Completed compiling
> command(queryId=hive_20260716191832_75c3783e-3e19-476d-a293-fd513629ddea);
> Time taken: 0.003 seconds
> INFO : Executing
> command(queryId=hive_20260716191832_75c3783e-3e19-476d-a293-fd513629ddea):
> drop role role_100
> INFO : Starting task [Stage-0:DDL] in serial mode
> INFO : Completed executing
> command(queryId=hive_20260716191832_75c3783e-3e19-476d-a293-fd513629ddea);
> Time taken: 0.043 seconds
> INFO : OK
> No rows affected (0.061 seconds)
> # # This reproduces the issue.
> 0: jdbc:hive2://ccycloud-1.cdpd102205p01d06.r> grant role role_100 to user
> hdfs;
>
> INFO : Compiling
> command(queryId=hive_20260716191903_17958d74-c978-47b5-bbf4-f5cee5cc16e2):
> grant role role_100 to user hdfs
> INFO : Semantic Analysis Completed (retrial = false)
>
>
> INFO : Created Hive schema: Schema(fieldSchemas:null, properties:null)
>
>
> INFO : Completed compiling
> command(queryId=hive_20260716191903_17958d74-c978-47b5-bbf4-f5cee5cc16e2);
> Time taken: 0.003 seconds
> INFO : Executing
> command(queryId=hive_20260716191903_17958d74-c978-47b5-bbf4-f5cee5cc16e2):
> grant role role_100 to user hdfs
> INFO : Starting task [Stage-0:DDL] in serial mode
>
>
> ERROR : Failed
>
>
> org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException:
> java.lang.Exception: HTTP 400 Error: User doesn't have permissions to grant
> role role_100
>
>
> at
> org.apache.ranger.authorization.hive.authorizer.RangerHiveAuthorizer.grantRole(RangerHiveAuthorizer.java:585)
> ~[ranger-hive-plugin-2.8.0.7.3.2.20000-
> 134.jar:2.8.0.7.3.2.20000-134]
>
>
> at
> org.apache.hadoop.hive.ql.ddl.privilege.role.grant.GrantRoleOperation.execute(GrantRoleOperation.java:53)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.
> 1.3000.7.3.2.20000-134]
>
>
> at org.apache.hadoop.hive.ql.ddl.DDLTask.execute(DDLTask.java:84)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
>
> at org.apache.hadoop.hive.ql.exec.Task.executeTask(Task.java:213)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
>
> at
> org.apache.hadoop.hive.ql.exec.TaskRunner.runSequential(TaskRunner.java:105)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.Executor.launchTask(Executor.java:354)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
>
> at org.apache.hadoop.hive.ql.Executor.launchTasks(Executor.java:327)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
>
> at org.apache.hadoop.hive.ql.Executor.runTasks(Executor.java:244)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
>
> at org.apache.hadoop.hive.ql.Executor.execute(Executor.java:105)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
>
> at org.apache.hadoop.hive.ql.Driver.execute(Driver.java:843)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
>
> at org.apache.hadoop.hive.ql.Driver.runInternal(Driver.java:695)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
>
> at org.apache.hadoop.hive.ql.Driver.run(Driver.java:536)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
>
> at org.apache.hadoop.hive.ql.Driver.run(Driver.java:530)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
>
> at
> org.apache.hadoop.hive.ql.reexec.ReExecDriver.run(ReExecDriver.java:190)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at
> org.apache.hive.service.cli.operation.SQLOperation.runQuery(SQLOperation.java:232)
> ~[hive-service-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-1
> 34]
>
>
> at
> org.apache.hive.service.cli.operation.SQLOperation$BackgroundWork$1.run(SQLOperation.java:336)
> ~[hive-service-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7
> .3.2.20000-134]
>
>
> at
> java.security.AccessController.doPrivileged(AccessController.java:712) ~[?:?]
>
> at javax.security.auth.Subject.doAs(Subject.java:439) ~[?:?]
>
>
> at
> org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1964)
> ~[hadoop-common-3.4.2.7.3.2.20000-134.jar:?]
> at
> org.apache.hive.service.cli.operation.SQLOperation$BackgroundWork.run(SQLOperation.java:356)
> ~[hive-service-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3
> .2.20000-134]
>
>
> at
> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539)
> ~[?:?]
> at java.util.concurrent.FutureTask.run(FutureTask.java:264) ~[?:?]
>
>
> at
> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539)
> ~[?:?]
> at java.util.concurrent.FutureTask.run(FutureTask.java:264) ~[?:?]
>
>
> at
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
> ~[?:?]
> at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
> ~[?:?]
> at java.lang.Thread.run(Thread.java:840) ~[?:?]
>
>
> Caused by: java.lang.Exception: HTTP 400 Error: User doesn't have permissions
> to grant role role_100
> at
> org.apache.ranger.admin.client.RangerAdminRESTClient.grantRole(RangerAdminRESTClient.java:571)
> ~[ranger-plugins-common-2.8.0.7.3.2.20000-134.jar:2.8.
> 0.7.3.2.20000-134]
> ... 26 more
> ERROR : DDLTask failed, DDL Operation: class
> org.apache.hadoop.hive.ql.ddl.privilege.role.grant.GrantRoleOperation
> org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException:
> java.lang.Exception: HTTP 400 Error: User doesn't have permissions to grant
> role role_100
> at
> org.apache.ranger.authorization.hive.authorizer.RangerHiveAuthorizer.grantRole(RangerHiveAuthorizer.java:585)
> ~[ranger-hive-plugin-2.8.0.7.3.2.20000-134.jar:2.8.0.7.3.2.20000-134]
> at
> org.apache.hadoop.hive.ql.ddl.privilege.role.grant.GrantRoleOperation.execute(GrantRoleOperation.java:53)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.ddl.DDLTask.execute(DDLTask.java:84)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.exec.Task.executeTask(Task.java:213)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at
> org.apache.hadoop.hive.ql.exec.TaskRunner.runSequential(TaskRunner.java:105)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.Executor.launchTask(Executor.java:354)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.Executor.launchTasks(Executor.java:327)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.Executor.runTasks(Executor.java:244)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.Executor.execute(Executor.java:105)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.Driver.execute(Driver.java:843)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.Driver.runInternal(Driver.java:695)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.Driver.run(Driver.java:536)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.Driver.run(Driver.java:530)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at
> org.apache.hadoop.hive.ql.reexec.ReExecDriver.run(ReExecDriver.java:190)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at
> org.apache.hive.service.cli.operation.SQLOperation.runQuery(SQLOperation.java:232)
> ~[hive-service-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at
> org.apache.hive.service.cli.operation.SQLOperation$BackgroundWork$1.run(SQLOperation.java:336)
> ~[hive-service-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at
> java.security.AccessController.doPrivileged(AccessController.java:712) ~[?:?]
> at javax.security.auth.Subject.doAs(Subject.java:439) ~[?:?]
> at
> org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1964)
> ~[hadoop-common-3.4.2.7.3.2.20000-134.jar:?]
> at
> org.apache.hive.service.cli.operation.SQLOperation$BackgroundWork.run(SQLOperation.java:356)
> ~[hive-service-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at
> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539) ~[?:?]
> at java.util.concurrent.FutureTask.run(FutureTask.java:264) ~[?:?]
> at
> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539) ~[?:?]
> at java.util.concurrent.FutureTask.run(FutureTask.java:264) ~[?:?]
> at
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
> ~[?:?]
> at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
> ~[?:?]
> at java.lang.Thread.run(Thread.java:840) ~[?:?]
> Caused by: java.lang.Exception: HTTP 400 Error: User doesn't have permissions
> to grant role role_100
> at
> org.apache.ranger.admin.client.RangerAdminRESTClient.grantRole(RangerAdminRESTClient.java:571)
> ~[ranger-plugins-common-2.8.0.7.3.2.20000-134.jar:2.8.0.7.3.2.20000-134]
> at
> org.apache.ranger.plugin.service.RangerBasePlugin.grantRole(RangerBasePlugin.java:1061)
> ~[ranger-plugins-common-2.8.0.7.3.2.20000-134.jar:2.8.0.7.3.2.20000-134]
> at
> org.apache.ranger.authorization.hive.authorizer.RangerHiveAuthorizer.grantRole(RangerHiveAuthorizer.java:582)
> ~[ranger-hive-plugin-2.8.0.7.3.2.20000-134.jar:2.8.0.7.3.2.20000-134]
> ... 26 more
> ERROR : FAILED: Execution Error, return code 40000 from
> org.apache.hadoop.hive.ql.ddl.DDLTask. java.lang.Exception: HTTP 400 Error:
> User doesn't have permissions to grant role role_100
> INFO : Completed executing
> command(queryId=hive_20260716191903_17958d74-c978-47b5-bbf4-f5cee5cc16e2);
> Time taken: 0.028 seconds
> INFO : OK
> Error: Error while compiling statement: FAILED: Execution Error, return code
> 40000 from org.apache.hadoop.hive.ql.ddl.DDLTask. java.lang.Exception: HTTP
> 400 Error: User doesn't have permissions to grant role role_100; Query ID:
> hive_20260716191903_17958d74-c978-47b5-bbf4-f5cee5cc16e2
> (state=08S01,code=40000)
> {code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
