From 70112d877a0e5f62d91996a5a8adced7e8d5bdc7 Mon Sep 17 00:00:00 2001 From: Muhammad Naayif Date: Fri, 18 Sep 2026 19:32:53 +0530 Subject: [PATCH] [fix](ranger) Document and hint Ranger UserStore group evaluation - Documents why createRequest() omits userGroups to preserve backward compatibility. - Adds an INFO log in RangerDorisPlugin to hint operators to set ranger.plugin.doris.use.rangerGroups=true. - Adds RangerTest.testRequestDoesNotCarryRolesOrGroups to lock in the default behavior. --- .../doris/RangerDorisAccessController.java | 5 +++++ .../ranger/doris/RangerDorisPlugin.java | 9 +++++++++ .../authorizer/ranger/doris/RangerTest.java | 18 ++++++++++++++++++ 3 files changed, 32 insertions(+) diff --git a/fe/fe-authorization/fe-authorization-plugins/fe-authorization-plugin-ranger-doris/src/main/java/org/apache/doris/catalog/authorizer/ranger/doris/RangerDorisAccessController.java b/fe/fe-authorization/fe-authorization-plugins/fe-authorization-plugin-ranger-doris/src/main/java/org/apache/doris/catalog/authorizer/ranger/doris/RangerDorisAccessController.java index 68c9c7cb4c0141..99159ea8cb6f50 100644 --- a/fe/fe-authorization/fe-authorization-plugins/fe-authorization-plugin-ranger-doris/src/main/java/org/apache/doris/catalog/authorizer/ranger/doris/RangerDorisAccessController.java +++ b/fe/fe-authorization/fe-authorization-plugins/fe-authorization-plugin-ranger-doris/src/main/java/org/apache/doris/catalog/authorizer/ranger/doris/RangerDorisAccessController.java @@ -263,6 +263,11 @@ protected RangerAccessRequestImpl createRequest(AuthorizedSubject subject, Acces // granting - and denying - on policies this source has never matched, in every deployment that has // any. That is a change to what an existing Ranger service decides and belongs with a release note // of its own, not here. + // + // User groups are omitted for the same reason. Ranger already attaches UserStore groups during + // RangerDefaultRequestProcessor.preProcess() when the operator sets + // ranger.plugin.doris.use.rangerGroups=true in ranger-doris-security.xml. Calling setUserGroups() + // here would start matching group items in every deployment, including those that never opted in. request.setClientIPAddress(clientAddressOf(subject, context)); request.setClusterType(CLIENT_TYPE_DORIS); request.setClientType(CLIENT_TYPE_DORIS); diff --git a/fe/fe-authorization/fe-authorization-plugins/fe-authorization-plugin-ranger-doris/src/main/java/org/apache/doris/catalog/authorizer/ranger/doris/RangerDorisPlugin.java b/fe/fe-authorization/fe-authorization-plugins/fe-authorization-plugin-ranger-doris/src/main/java/org/apache/doris/catalog/authorizer/ranger/doris/RangerDorisPlugin.java index 0da65aaeb7f097..c7dc64bca3cfe3 100644 --- a/fe/fe-authorization/fe-authorization-plugins/fe-authorization-plugin-ranger-doris/src/main/java/org/apache/doris/catalog/authorizer/ranger/doris/RangerDorisPlugin.java +++ b/fe/fe-authorization/fe-authorization-plugins/fe-authorization-plugin-ranger-doris/src/main/java/org/apache/doris/catalog/authorizer/ranger/doris/RangerDorisPlugin.java @@ -17,10 +17,14 @@ package org.apache.doris.catalog.authorizer.ranger.doris; +import org.apache.logging.log4j.LogManager; +import org.apache.logging.log4j.Logger; import org.apache.ranger.plugin.service.RangerAuthContextListener; import org.apache.ranger.plugin.service.RangerBasePlugin; public class RangerDorisPlugin extends RangerBasePlugin { + private static final Logger LOG = LogManager.getLogger(RangerDorisPlugin.class); + public RangerDorisPlugin(String serviceName) { this(serviceName, null); } @@ -28,6 +32,11 @@ public RangerDorisPlugin(String serviceName) { public RangerDorisPlugin(String serviceName, RangerAuthContextListener rangerAuthContextListener) { super(serviceName, null, null); super.init(); + if (getConfig() != null && !getConfig().isUseRangerGroups()) { + LOG.info("Ranger UserStore groups are downloaded but not evaluated. Set " + + "ranger.plugin.doris.use.rangerGroups=true in ranger-doris-security.xml to " + + "enable group-based policies, row filters, and column masks."); + } super.registerAuthContextEventListener(rangerAuthContextListener); } } diff --git a/fe/fe-authorization/fe-authorization-plugins/fe-authorization-plugin-ranger-doris/src/test/java/org/apache/doris/catalog/authorizer/ranger/doris/RangerTest.java b/fe/fe-authorization/fe-authorization-plugins/fe-authorization-plugin-ranger-doris/src/test/java/org/apache/doris/catalog/authorizer/ranger/doris/RangerTest.java index b43973476a391b..8b038cd37e091d 100644 --- a/fe/fe-authorization/fe-authorization-plugins/fe-authorization-plugin-ranger-doris/src/test/java/org/apache/doris/catalog/authorizer/ranger/doris/RangerTest.java +++ b/fe/fe-authorization/fe-authorization-plugins/fe-authorization-plugin-ranger-doris/src/test/java/org/apache/doris/catalog/authorizer/ranger/doris/RangerTest.java @@ -32,6 +32,7 @@ import com.google.common.collect.Lists; import com.google.common.collect.Sets; import org.apache.ranger.plugin.policyengine.RangerAccessRequest; +import org.apache.ranger.plugin.policyengine.RangerAccessRequestImpl; import org.apache.ranger.plugin.policyengine.RangerAccessResource; import org.apache.ranger.plugin.policyengine.RangerAccessResult; import org.apache.ranger.plugin.policyengine.RangerAccessResultProcessor; @@ -353,4 +354,21 @@ public void testTheDefaultWorkloadGroupIsNotAskedAbout() throws AccessDeniedExce Assertions.assertEquals(0, plugin.requests.get(), "the default workload group was put to the policy engine"); } + + /** + * Roles and groups stay off the request this source builds. Ranger-hive sends Doris roles; this + * source does not, and groups belong to Ranger's {@code use.rangerGroups} preprocessing, not to + * this builder. Putting either on the request would start matching policy items this source has + * never matched. + */ + @Test + public void testRequestDoesNotCarryRolesOrGroups() { + RangerAccessRequestImpl request = controller().createRequest(USER, AccessContext.NONE); + + Assertions.assertEquals("user1", request.getUser()); + Assertions.assertTrue(request.getUserGroups() == null || request.getUserGroups().isEmpty(), + "groups were attached in createRequest rather than left to Ranger preprocessing"); + Assertions.assertTrue(request.getUserRoles() == null || request.getUserRoles().isEmpty(), + "roles were attached in createRequest, which this source has never done"); + } }