abhiishek26 opened a new pull request, #1308: URL: https://github.com/apache/ranger/pull/1308
In the above Jira https://issues.apache.org/jira/browse/RANGER-5811 . as mentioned the usersync is configured not to fetch user group mappings due to which associated groups of a logged in user can not be identified . So suppose a user is mapped to a group in LDAP so when we sync the user and group to the ranger admin their mappings are not fetched . So it creates the following problem as mentioned in jira Group G1 and User U1 created in LDAP and U1 is mapped to G1 in LDAP . UserSync sync U1 and G1 but not the user group mapping . Now we create a role R1 and group G1 is added to role R1 Now we assign delegate admin role to R1 , so ideally all the users present in G1 should have got the delegate admin permission , but this will not happen due to the absence of user group mapping Solution :- Integrating a flag based approach to use Hadoop UGI ° If it is set to false it will default to the previous behaviour of using ranger db (x_group_users)to identify user group mappings . ° If set to true approach bypasses Ranger's internal database (the x_group_users ) by resolving user groups directly from Hadoop's UGI/group-mapping mechanism . The above approach is based on the Atlas integration of ugi to solve similar problem . Changes Made :- Changes have been made in RangerAuthenticationProvider.java class to implement the Ugi based approach . Also since the jira was about delegate admin permission , changes have been made in the getGroupsForUser function in the XUserMgr.java since that function is being used to resolve user group mappings . If the flag is false it will use the old db based approach and if it is true ugi based implementations will be called from inside the function . How this patch was tested ? 1>The changes were tested locally for any violations -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
