Vyom Mani Tiwari created RANGER-5739:
----------------------------------------
Summary: Recursive URL resource policy does not match resources
expressed in the default-FileSystem URL form (scheme:///path)
Key: RANGER-5739
URL: https://issues.apache.org/jira/browse/RANGER-5739
Project: Ranger
Issue Type: Bug
Components: Ranger
Affects Versions: 2.9.0, 2.8.0
Reporter: Vyom Mani Tiwari
Assignee: Vyom Mani Tiwari
{{RangerURLResourceMatcher}} fails to match a *recursive* URL policy against a
request resource when both are written in the {{scheme:///path}} form (three
slashes after the colon) — the standard way to reference the Hadoop _default_
FileSystem, i.e. a URL with no explicit host/authority.
For example, a recursive policy value of:
{{hdfs:///app/warehouse/*}}
does not match a request resource of:
{{hdfs:///app/warehouse/data}}
even though:
* the identical policy value matches the identical resource correctly when the
policy is *not* marked recursive, and
* the same recursive matching correctly handles the explicit-authority form,
e.g. policy {{hdfs://nn1:8020/app/warehouse/*}} against resource
{{{}hdfs://nn1:8020/app/warehouse/data{}}}.
This makes recursive policies unusable for any URL resource expressed in the
default-FS form, which is a common way to reference HDFS/local paths without an
explicit namenode authority (e.g. Hive external table {{{}LOCATION{}}},
{{{}LOAD DATA INPATH{}}}).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
