[
https://issues.apache.org/jira/browse/RANGER-5793?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Vyom Mani Tiwari resolved RANGER-5793.
--------------------------------------
Fix Version/s: 2.10
Resolution: Fixed
> Align delegated-admin checks for policy update and delete when access grants
> are unchanged
> ------------------------------------------------------------------------------------------
>
> Key: RANGER-5793
> URL: https://issues.apache.org/jira/browse/RANGER-5793
> Project: Ranger
> Issue Type: Bug
> Components: admin
> Affects Versions: 2.9.0
> Reporter: Vyom Mani Tiwari
> Assignee: Vyom Mani Tiwari
> Priority: Major
> Fix For: 3.0.0, 2.10
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> Delegated-admin authorization for policy modify currently treats an
> unchanged access-grant set differently from a resource-signature
> change or a read of the same policy.
> When the computed access-type delta is empty, the modify path
> authorizes against a generic admin token instead of the policy's
> full access-type set. That makes update and delete of an existing
> policy inconsistent with GET and with an update that changes the
> resource signature.
> Also clean up collectAccessTypes so each principal owns its own
> access-type set (the current shared HashSet can alias across
> users/groups/roles on the same item).
> Expected:
> - Read, update, and delete of a given policy require delegated-admin
> authority over the same access-type set that policy contains,
> including when only non-grant fields change or the policy is
> removed.
> - collectAccessTypes does not share a mutable Set across principals.
> Related: RANGER-1718 (diff considers access types only).
> No functional change intended for callers who already hold
> delegated-admin on every access type present in the policy.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
