mneethiraj commented on code in PR #1265:
URL: https://github.com/apache/ranger/pull/1265#discussion_r4140642202
##########
agents-common/src/main/java/org/apache/ranger/plugin/service/RangerDefaultRequestProcessor.java:
##########
@@ -173,6 +175,63 @@ public void enrich(RangerAccessRequest request) {
}
}
+ private void normalizeUserAndGroups(RangerAccessRequestImpl reqImpl,
RangerPluginContext pluginContext, RangerBatchEvalContext batchEvalContext,
String originalUser, Set<String> originalGroups) {
+ if (batchEvalContext != null) {
+ String mappedUser =
batchEvalContext.getMappedUserName(originalUser);
+ Set<String> mappedUserGroups =
batchEvalContext.getMappedUserGroups(originalUser, originalGroups);
+ // A mapped user or group set can be null, so a null return is a
hit when the key is present.
+ boolean userMissing = mappedUser == null &&
!batchEvalContext.hasMappingForUserName(originalUser);
+ boolean groupsMissing = mappedUserGroups == null &&
!batchEvalContext.hasMappingForUserGroups(originalUser, originalGroups);
+
+ if (userMissing || groupsMissing) {
+ mapUserAndGroups(reqImpl, pluginContext);
+
+ batchEvalContext.setUserNameMapping(originalUser,
reqImpl.getUser());
+
+ Set<String> groups = reqImpl.getUserGroups();
+
+ if (groups != null) {
+ groups = copyReadOnly(groups);
+
+ reqImpl.setUserGroups(groups);
+ }
+
+ batchEvalContext.setUserGroupsMapping(originalUser,
originalGroups, groups);
+ } else {
+ reqImpl.setUser(mappedUser);
+
+ if (mappedUserGroups != null) {
Review Comment:
Shouldn't `reqImpl.setUserGroups()` be called irrespective of null value,
similar to in earlier version at line 114?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
