Skip to content

[fix](ranger) Document and hint Ranger UserStore group evaluation - #68203

Open
naayifmuhammad wants to merge 1 commit into
apache:masterfrom
naayifmuhammad:fix-ranger-group-authorization
Open

naayifmuhammad wants to merge 1 commit into
apache:masterfrom
naayifmuhammad:fix-ranger-group-authorization

Conversation

@naayifmuhammad

Copy link
Copy Markdown

title:
fix Document and hint Ranger UserStore group evaluation

What problem does this PR solve?

Issue Number: None

Related PR: None

Problem Summary:
Ranger group-based policies, row-level filters, and column masks on the internal catalog are never applied because RangerDorisAccessController.createRequest() builds requests without userGroups.

Instead of manually injecting groups into createRequest() (which would alter policy evaluation for existing deployments), this PR delegates group evaluation to Ranger's native RangerDefaultRequestProcessor.preProcess().

Key modifications:

  • RangerDorisAccessController.java: Documents why userGroups are omitted in createRequest() to maintain backward compatibility.
  • RangerDorisPlugin.java: Adds an INFO log on startup to hint operators to set ranger.plugin.doris.use.rangerGroups=true in ranger-doris-security.xml if they wish to enable group evaluation.
  • RangerTest.java: Adds testRequestDoesNotCarryRolesOrGroups to lock in the backward-compatible default behavior.

Release note

Operators who want Ranger group, row-filter, and column-mask policies to apply must set <property><name>ranger.plugin.doris.use.rangerGroups</name><value>true</value></property> in ranger-doris-security.xml and restart the FE. Default behavior remains user-only evaluation.

Check List (For Author)

  • Test

    • Regression test
    • Unit Test
    • Manual test (add detailed scripts or steps below)
    • No need to test or manual test. Explain why:
  • Behavior changed:

    • No.
    • Yes. Operators can now evaluate Ranger group policies by setting ranger.plugin.doris.use.rangerGroups=true. Default remains unchanged.
  • Does this need documentation?

    • No.
    • Yes.

Check List (For Reviewer who merge this PR)

  • Confirm the release note
  • Confirm test cases
  • Confirm document
  • Add branch pick label

- Documents why createRequest() omits userGroups to preserve backward compatibility.
- Adds an INFO log in RangerDorisPlugin to hint operators to set ranger.plugin.doris.use.rangerGroups=true.
- Adds RangerTest.testRequestDoesNotCarryRolesOrGroups to lock in the default behavior.
@hello-stephen

Copy link
Copy Markdown
Contributor

Thank you for your contribution to Apache Doris.
Don't know what should be done next? See How to process your PR.

Please clearly describe your PR:

  1. What problem was fixed (it's best to include specific error reporting information). How it was fixed.
  2. Which behaviors were modified. What was the previous behavior, what is it now, why was it modified, and what possible impacts might there be.
  3. What features were added. Why was this function added?
  4. Which code was refactored and why was this part of the code refactored?
  5. Which functions were optimized and what is the difference before and after the optimization?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants