[
https://issues.apache.org/jira/browse/RANGER-5796?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18124526#comment-18124526
]
Akash Gupta commented on RANGER-5796:
-------------------------------------
duplicate ticket RANGER-5820 is the original one. closing this.
> Concurrent GRANT requests from Impala-shell fail with MySQL x_policy unique
> constraint violations (UK_service_signature, UK_name_service_zone) exposed as
> raw HTTP 400 errors
> -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: RANGER-5796
> URL: https://issues.apache.org/jira/browse/RANGER-5796
> Project: Ranger
> Issue Type: Bug
> Components: Ranger
> Reporter: Akash Gupta
> Priority: Major
> Fix For: 3.0.0
>
>
> Ranger Admin's policy creation code path (invoked when Impala sends a GRANT
> request requiring a new policy row) is not thread-safe under concurrent
> execution.
> When multiple GRANT statements execute in parallel, they trigger MySQL Unique
> Key constraint violations on the table. Rather than handling these race
> conditions gracefully or surfacing a retryable conflict, Ranger Admin
> propagates raw JDBC/EclipseLink database stack traces to the REST client as
> an {*}HTTP 400 Bad Request{*}.
> {*}Sequential execution of the exact same GRANT operations on same resources
> and roles succeeds without issue{*}, confirming this is strictly a
> concurrency control defect in Ranger Admin.
> h3. *Expected Behaviour*
> # *Concurrency Control:* Ranger Admin should serialise or merge concurrent
> create-policy requests cleanly (returning HTTP 200), or return an actionable
> *HTTP 409 Conflict* allowing clients to retry.
> # *Unique Naming:* Policy name generation must use thread-safe unique
> identifiers (e.g., UUIDs or sequence numbers) rather than
> millisecond-resolution timestamps.
> # *Abstraction:* Internal database implementation details (EclipseLink,
> x_policy, JDBC types, MySQL 1062 codes) must never cross the REST API
> boundary.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
