Abhishek Singh created RANGER-5811:
--------------------------------------
Summary: Resolve group mapping for ranger using hadoop UGI
Key: RANGER-5811
URL: https://issues.apache.org/jira/browse/RANGER-5811
Project: Ranger
Issue Type: Improvement
Components: Ranger
Affects Versions: 3.0.0
Reporter: Abhishek Singh
Assignee: Abhishek Singh
This is a new feature request for Ranger user sync service:
The usersync is configured not to fetch user group mappings due to which
associated groups of a logged in user can not be identified . So suppose a user
is mapped to a group in LDAP so when we sync the user and group to the ranger
admin their mappings are not fetched .
So it creates the following problem :-
* Group G1 and User U1 created in LDAP and U1 is mapped to G1 in LDAP .
* UserSync sync U1 and G1 but not the user group mapping .
* Now we create a role R1 and group G1 is added to role R1
* Now we assign delegate admin role to R1 , so ideally all the users present
in G1 should have got the delegate admin permission , but this will not happen
due to the absence of user group mapping
The above problem can be solve using Hadoop UGI which will dynamically resolve
user group mappings instead of relying on the ranger db (x_group_users table)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
