nevzheng opened a new issue, #14247:
URL: https://github.com/apache/gravitino/issues/14247
### Version
main branch
### Describe what's wrong
`UserGroupManager.removeUser` and `removeGroup` only delete the principal
from the entity store. The
store also soft-deletes the principal's role relations, but no authorization
plugin callback runs.
Granting a role calls `onGrantedRolesToUser` / `onGrantedRolesToGroup`,
which for Ranger adds the
principal to the Ranger role `GRAVITINO_<role>`. Removing the principal
never calls
`onRevokedRolesFromUser` / `onRevokedRolesFromGroup`, so Ranger keeps it as
a member of every role it
was granted through Gravitino. Engines that enforce through the plugin (for
example Spark or Trino with
the Ranger plugin) keep applying those roles to the removed principal, while
Gravitino shows it as gone.
If the same name is added again, Gravitino shows no roles but Ranger still
applies the old ones.
The bulk `removeUsers` / `removeGroups` paths behave the same.
### Error message and/or stacktrace
None. `DELETE /api/metalakes/m/users/u1` returns `{"removed": true}`.
### How to reproduce
1. Enable authorization and create a Hive catalog `c` with
`authorization-provider=ranger`.
2. Add user `u1`, create role `r1` with `SELECT_TABLE` on `c`, and grant
`r1` to `u1`. The Ranger role
`GRAVITINO_r1` now lists `u1`.
3. `DELETE /api/metalakes/m/users/u1`.
4. Reload the Ranger role `GRAVITINO_r1`.
Expected: `u1` is no longer a member of `GRAVITINO_r1`.
Actual: `u1` is still a member.
The same happens for a group with `DELETE /api/metalakes/m/groups/g1`.
### Additional context
Proposed fix: read the principal's roles before the delete and, after a
successful delete, call
`onRevokedRolesFromUser` / `onRevokedRolesFromGroup` on the plugin of each
affected catalog, filtering
the roles per catalog as `PermissionManager.revokeRolesFromUser/Group` does.
Not covered here: owner policies created by `onOwnerSet` also stay in the
plugin after the owner is
removed. There is no existing hook to clear an owner, so that needs a
separate change.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
