kumaab commented on code in PR #1201:
URL: https://github.com/apache/ranger/pull/1201#discussion_r4007884076
##########
hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessor.java:
##########
@@ -1434,8 +1434,25 @@ boolean canSkipAccessCheck(User user, final String
operation, String access, fin
/* ---- EndpointObserver implementation ---- */
- boolean isAccessForMetadataRead(String access, String table) {
+ boolean isAccessForMetadataRead(String access, String table, User user) {
if (authUtils.isReadAccess(access) && isSpecialTable(table)) {
+ if (StringUtils.equals(table, "hbase:acl")) {
+ boolean isSystemOrSuperUser = false;
+ try {
+ User currentUser = User.getCurrent();
+ if (currentUser != null && user != null) {
+ isSystemOrSuperUser =
Objects.equals(currentUser.getShortName(), user.getShortName());
+ }
+ } catch (IOException e) {
+ LOG.warn("Unable to obtain the current user", e);
+ }
+ if (!isSystemOrSuperUser && user != null) {
+ isSystemOrSuperUser = userUtils.isSuperUser(user);
+ }
+ if (!isSystemOrSuperUser) {
+ return false;
+ }
+ }
LOG.debug("isAccessForMetadataRead: Metadata tables read: access
allowed!");
Review Comment:
debug could be updated to also log when the access is not allowed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
