[
https://issues.apache.org/jira/browse/RANGER-5678?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Sanket Shelar reassigned RANGER-5678:
-------------------------------------
Assignee: Vyom Mani Tiwari (was: Sanket Shelar)
> Concurrent policy-engine rebuild on shared serviceDef causes CME/NPE for
> delegated-admin User
> ----------------------------------------------------------------------------------------------
>
> Key: RANGER-5678
> URL: https://issues.apache.org/jira/browse/RANGER-5678
> Project: Ranger
> Issue Type: Bug
> Components: Ranger
> Affects Versions: 3.0.0
> Reporter: Sanket Shelar
> Assignee: Vyom Mani Tiwari
> Priority: Major
> Time Spent: 1h 50m
> Remaining Estimate: 0h
>
> Under concurrent delegated-admin V2 API(
> {baseUrl}/service/public/v2/api/service/\{service-name}/policy) load (policy
> LIST + CREATE/UPDATE/DELETE), multiple Tomcat threads rebuild the policy
> engine for the same service (e.g. cm_hive) in parallel. Each rebuild calls
> ServiceDefUtil.normalize() *in-place* on the *same* serviceDef object from
> RangerServicePoliciesCache.
> This causes:
> * ConcurrentModificationException in normalizeDataMaskDef /
> normalizeRowFilterDef
> * NullPointerException
> * getPolicyAdmin(<service>): failed to get latest policies from service-store
>
>
> {code:java}
> 026-07-08 09:31:19,045 ERROR org.apache.ranger.biz.RangerPolicyAdminCache:
> [https-jsse-nio-6182-exec-15]: getPolicyAdmin(cm_hive): failed to get latest
> policies from service-store
> java.util.ConcurrentModificationException
> at java.util.ArrayList$Itr.checkForComodification(ArrayList.java:909)
> at java.util.ArrayList$Itr.next(ArrayList.java:859)
> at
> org.apache.ranger.plugin.util.ServiceDefUtil.normalizeDataMaskDef(ServiceDefUtil.java:319)
> at
> org.apache.ranger.plugin.util.ServiceDefUtil.normalize(ServiceDefUtil.java:97)
> at
> org.apache.ranger.plugin.policyengine.RangerPolicyRepository.<init>(RangerPolicyRepository.java:187)
> at
> org.apache.ranger.plugin.policyengine.RangerPolicyRepository.<init>(RangerPolicyRepository.java:180)
> at
> org.apache.ranger.plugin.policyengine.PolicyEngine.<init>(PolicyEngine.java:225)
> at
> org.apache.ranger.biz.RangerPolicyAdminImpl.<init>(RangerPolicyAdminImpl.java:96)
> at
> org.apache.ranger.biz.RangerPolicyAdminCache.addPolicyAdmin(RangerPolicyAdminCache.java:199)
> at
> org.apache.ranger.biz.RangerPolicyAdminCache.addOrUpdatePolicyAdmin(RangerPolicyAdminCache.java:166)
> at
> org.apache.ranger.biz.RangerPolicyAdminCache.getServicePoliciesAdmin(RangerPolicyAdminCache.java:103)
> at
> org.apache.ranger.biz.RangerPolicyAdminCacheForEngineOptions.getServicePoliciesAdmin(RangerPolicyAdminCacheForEngineOptions.java:73)
> at
> org.apache.ranger.biz.RangerPolicyAdminCacheForEngineOptions.getServicePoliciesAdmin(RangerPolicyAdminCacheForEngineOptions.java:54)
> at
> org.apache.ranger.rest.ServiceREST.getPolicyAdminForDelegatedAdmin(ServiceREST.java:3969)
> {code}
>
>
> {code:java}
> 2026-07-08 09:31:23,401 ERROR org.apache.ranger.biz.RangerPolicyAdminCache:
> [https-jsse-nio-6182-exec-13]: getPolicyAdmin(cm_hive): failed to get latest
> policies from service-store
> java.lang.NullPointerException
> at
> org.apache.ranger.plugin.model.validation.RangerServiceDefHelper$Delegate.isValid(RangerServiceDefHelper.java:509)
> at
> org.apache.ranger.plugin.model.validation.RangerServiceDefHelper$Delegate.<init>(RangerServiceDefHelper.java:346)
> at
> org.apache.ranger.plugin.model.validation.RangerServiceDefHelper.<init>(RangerServiceDefHelper.java:157)
> at
> org.apache.ranger.plugin.model.validation.RangerServiceDefHelper.<init>(RangerServiceDefHelper.java:127)
> at
> org.apache.ranger.plugin.policyengine.RangerPolicyRepository.init(RangerPolicyRepository.java:880)
> at
> org.apache.ranger.plugin.policyengine.RangerPolicyRepository.<init>(RangerPolicyRepository.java:229)
> at
> org.apache.ranger.plugin.policyengine.RangerPolicyRepository.<init>(RangerPolicyRepository.java:180)
> at
> org.apache.ranger.plugin.policyengine.PolicyEngine.<init>(PolicyEngine.java:225)
> at
> org.apache.ranger.biz.RangerPolicyAdminImpl.<init>(RangerPolicyAdminImpl.java:96)
> at
> org.apache.ranger.biz.RangerPolicyAdminCache.addPolicyAdmin(RangerPolicyAdminCache.java:199)
> at
> org.apache.ranger.biz.RangerPolicyAdminCache.addOrUpdatePolicyAdmin(RangerPolicyAdminCache.java:166)
> at
> org.apache.ranger.biz.RangerPolicyAdminCache.getServicePoliciesAdmin(RangerPolicyAdminCache.java:103)
> at
> org.apache.ranger.biz.RangerPolicyAdminCacheForEngineOptions.getServicePoliciesAdmin(RangerPolicyAdminCacheForEngineOptions.java:73)
> at
> org.apache.ranger.biz.RangerPolicyAdminCacheForEngineOptions.getServicePoliciesAdmin(RangerPolicyAdminCacheForEngineOptions.java:54)
> at
> org.apache.ranger.rest.ServiceREST.getPolicyAdminForDelegatedAdmin(ServiceREST.java:3969)
> at
> org.apache.ranger.rest.ServiceREST.applyAdminAccessFilter(ServiceREST.java:3842)
> at
> org.apache.ranger.rest.ServiceREST.getServicePolicies(ServiceREST.java:3277)
> at
> org.apache.ranger.rest.ServiceREST.getServicePoliciesByName(ServiceREST.java:3244)
> {code}
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
