vyommani commented on code in PR #1265:
URL: https://github.com/apache/ranger/pull/1265#discussion_r4140904147
##########
agents-common/src/main/java/org/apache/ranger/plugin/service/RangerDefaultRequestProcessor.java:
##########
@@ -173,6 +175,63 @@ public void enrich(RangerAccessRequest request) {
}
}
+ private void normalizeUserAndGroups(RangerAccessRequestImpl reqImpl,
RangerPluginContext pluginContext, RangerBatchEvalContext batchEvalContext,
String originalUser, Set<String> originalGroups) {
+ if (batchEvalContext != null) {
+ String mappedUser =
batchEvalContext.getMappedUserName(originalUser);
+ Set<String> mappedUserGroups =
batchEvalContext.getMappedUserGroups(originalUser, originalGroups);
+ // A mapped user or group set can be null, so a null return is a
hit when the key is present.
+ boolean userMissing = mappedUser == null &&
!batchEvalContext.hasMappingForUserName(originalUser);
+ boolean groupsMissing = mappedUserGroups == null &&
!batchEvalContext.hasMappingForUserGroups(originalUser, originalGroups);
+
+ if (userMissing || groupsMissing) {
+ mapUserAndGroups(reqImpl, pluginContext);
+
+ batchEvalContext.setUserNameMapping(originalUser,
reqImpl.getUser());
+
+ Set<String> groups = reqImpl.getUserGroups();
+
+ if (groups != null) {
+ groups = copyReadOnly(groups);
+
+ reqImpl.setUserGroups(groups);
+ }
+
+ batchEvalContext.setUserGroupsMapping(originalUser,
originalGroups, groups);
+ } else {
+ reqImpl.setUser(mappedUser);
+
+ if (mappedUserGroups != null) {
Review Comment:
Agreed. On a cache hit, setUserGroups() is now called together with
setUser(), as in the earlier code.
setUserGroups(null) replaces null with a new HashSet, so a null group set is
stored through copyReadOnly() as one shared Collections.emptySet(). Both the
miss path and the hit path call setUserGroups() with that set, and every
request in the batch shares it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
