[
https://issues.apache.org/jira/browse/IMPALA-15323?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Fang-Yu Rao updated IMPALA-15323:
---------------------------------
Description:
Due to RANGER-5777, Impala does not produce Ranger audit events for CREATE/DROP
ROLE. If we do not want to wait for the fix on the Ranger side, we may also
adopt the workaround for Apache Hive at [RangerHiveAuthorizer#createRole(String
roleName, HivePrincipal
adminGrantor)|https://github.com/apache/ranger/blob/0c62c8c/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizer.java#L344].
Recall that we recently also adopted a similar workaround and made Impala
produce Ranger audit events for GRANT/REVOKE ROLE TO/FROM USER/GROUP like what
is seen at
https://github.com/apache/impala/blob/a75fc10/fe/src/main/java/org/apache/impala/authorization/ranger/RangerCatalogdAuthorizationManager.java#L255.
It should not be too difficult to apply this to
[RangerCatalogdAuthorizationManager#createRole()|https://github.com/apache/impala/blob/a75fc10/fe/src/main/java/org/apache/impala/authorization/ranger/RangerCatalogdAuthorizationManager.java#L97-L115]
and
[RangerCatalogdAuthorizationManager#dropRole()|https://github.com/apache/impala/blob/a75fc10/fe/src/main/java/org/apache/impala/authorization/ranger/RangerCatalogdAuthorizationManager.java#L118-L141].
was:
Due to RANGER-5777, Impala does not produce Ranger audit events for CREATE/DROP
ROLE. If we do not want to wait for the fix on the Ranger side, we may also
adopt the workaround for Apache Hive at [RangerHiveAuthorizer#createRole(String
roleName, HivePrincipal
adminGrantor)|https://github.com/apache/ranger/blob/0c62c8c/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizer.java#L344].
> Make Impala produce Ranger audit events for CREATE/DROP ROLE
> ------------------------------------------------------------
>
> Key: IMPALA-15323
> URL: https://issues.apache.org/jira/browse/IMPALA-15323
> Project: IMPALA
> Issue Type: Improvement
> Affects Versions: Impala 5.0.0
> Reporter: Fang-Yu Rao
> Priority: Major
>
> Due to RANGER-5777, Impala does not produce Ranger audit events for
> CREATE/DROP ROLE. If we do not want to wait for the fix on the Ranger side,
> we may also adopt the workaround for Apache Hive at
> [RangerHiveAuthorizer#createRole(String roleName, HivePrincipal
> adminGrantor)|https://github.com/apache/ranger/blob/0c62c8c/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizer.java#L344].
> Recall that we recently also adopted a similar workaround and made Impala
> produce Ranger audit events for GRANT/REVOKE ROLE TO/FROM USER/GROUP like
> what is seen at
> https://github.com/apache/impala/blob/a75fc10/fe/src/main/java/org/apache/impala/authorization/ranger/RangerCatalogdAuthorizationManager.java#L255.
> It should not be too difficult to apply this to
> [RangerCatalogdAuthorizationManager#createRole()|https://github.com/apache/impala/blob/a75fc10/fe/src/main/java/org/apache/impala/authorization/ranger/RangerCatalogdAuthorizationManager.java#L97-L115]
> and
> [RangerCatalogdAuthorizationManager#dropRole()|https://github.com/apache/impala/blob/a75fc10/fe/src/main/java/org/apache/impala/authorization/ranger/RangerCatalogdAuthorizationManager.java#L118-L141].
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
