[
https://issues.apache.org/jira/browse/RANGER-5739?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Vyom Mani Tiwari resolved RANGER-5739.
--------------------------------------
Fix Version/s: 3.0.0
2.10
Resolution: Fixed
> Recursive URL resource policy does not match resources expressed in the
> default-FileSystem URL form (scheme:///path)
> --------------------------------------------------------------------------------------------------------------------
>
> Key: RANGER-5739
> URL: https://issues.apache.org/jira/browse/RANGER-5739
> Project: Ranger
> Issue Type: Bug
> Components: Ranger
> Affects Versions: 2.8.0, 2.9.0
> Reporter: Vyom Mani Tiwari
> Assignee: Vyom Mani Tiwari
> Priority: Critical
> Fix For: 3.0.0, 2.10
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> {{RangerURLResourceMatcher}} fails to match a *recursive* URL policy against
> a request resource when both are written in the {{scheme:///path}} form
> (three slashes after the colon) — the standard way to reference the Hadoop
> _default_ FileSystem, i.e. a URL with no explicit host/authority.
> For example, a recursive policy value of:
> {{hdfs:///app/warehouse/*}}
> does not match a request resource of:
> {{hdfs:///app/warehouse/data}}
> even though:
> * the identical policy value matches the identical resource correctly when
> the policy is *not* marked recursive, and
> * the same recursive matching correctly handles the explicit-authority form,
> e.g. policy {{hdfs://nn1:8020/app/warehouse/*}} against resource
> {{{}hdfs://nn1:8020/app/warehouse/data{}}}.
> This makes recursive policies unusable for any URL resource expressed in the
> default-FS form, which is a common way to reference HDFS/local paths without
> an explicit namenode authority (e.g. Hive external table {{{}LOCATION{}}},
> {{{}LOAD DATA INPATH{}}}).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
