This is an automated email from the ASF dual-hosted git repository.
madhan pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ranger.git
The following commit(s) were added to refs/heads/master by this push:
new 2e62cd346 RANGER-5403: fix intermittent HDFS authorization failures
(#737)
2e62cd346 is described below
commit 2e62cd346d845890eff8d39ecf9f66ec6c7a4711
Author: Madhan Neethiraj <[email protected]>
AuthorDate: Tue Nov 18 23:07:48 2025 -0800
RANGER-5403: fix intermittent HDFS authorization failures (#737)
Authored-by: Xuze Yang <[email protected]>
Signed-off-by: Madhan Neethiraj <[email protected]>
---
.../resourcematcher/RangerPathResourceMatcher.java | 22 +++++++++-----------
.../resourcematcher/RangerURLResourceMatcher.java | 24 ++++++++++------------
2 files changed, 21 insertions(+), 25 deletions(-)
diff --git
a/agents-common/src/main/java/org/apache/ranger/plugin/resourcematcher/RangerPathResourceMatcher.java
b/agents-common/src/main/java/org/apache/ranger/plugin/resourcematcher/RangerPathResourceMatcher.java
index 0685d1871..fd238db4f 100644
---
a/agents-common/src/main/java/org/apache/ranger/plugin/resourcematcher/RangerPathResourceMatcher.java
+++
b/agents-common/src/main/java/org/apache/ranger/plugin/resourcematcher/RangerPathResourceMatcher.java
@@ -596,8 +596,8 @@ static class RecursivePathResourceMatcher extends
AbstractPathResourceMatcher {
final IOCase ioCase;
final BiFunction<String, String, Boolean> primaryFunction;
final BiFunction<String, String, Boolean> fallbackFunction;
- String valueWithoutSeparator;
- String valueWithSeparator;
+ final String valueWithoutSeparator;
+ final String valueWithSeparator;
RecursivePathResourceMatcher(String value, Map<String, String>
options, char pathSeparatorChar, boolean optIgnoreCase, int priority) {
super(value, options, pathSeparatorChar, true, priority);
@@ -605,6 +605,14 @@ static class RecursivePathResourceMatcher extends
AbstractPathResourceMatcher {
this.ioCase = optIgnoreCase ? IOCase.INSENSITIVE :
IOCase.SENSITIVE;
this.primaryFunction = optIgnoreCase ?
StringUtils::equalsIgnoreCase : StringUtils::equals;
this.fallbackFunction = optIgnoreCase ?
StringUtils::startsWithIgnoreCase : StringUtils::startsWith;
+
+ if (this.value == null || getNeedsDynamicEval()) {
+ valueWithoutSeparator = null;
+ valueWithSeparator = null;
+ } else {
+ valueWithoutSeparator = getStringToCompare(this.value);
+ valueWithSeparator = valueWithoutSeparator +
pathSeparatorChar;
+ }
}
String getStringToCompare(String policyValue) {
@@ -626,11 +634,6 @@ boolean isMatch(String resourceValue, Map<String, Object>
evalContext) {
noSeparator = expandedPolicyValue != null ?
getStringToCompare(expandedPolicyValue) : null;
} else {
- if (valueWithoutSeparator == null && value != null) {
- valueWithoutSeparator = getStringToCompare(value);
- valueWithSeparator = valueWithoutSeparator +
pathSeparatorChar;
- }
-
noSeparator = valueWithoutSeparator;
}
@@ -669,11 +672,6 @@ public boolean isChildMatch(String resourceValue,
Map<String, Object> evalContex
noSeparator = expandedPolicyValue != null ?
getStringToCompare(expandedPolicyValue) : null;
} else {
- if (valueWithoutSeparator == null && value != null) {
- valueWithoutSeparator = getStringToCompare(value);
- valueWithSeparator = valueWithoutSeparator +
pathSeparatorChar;
- }
-
noSeparator = valueWithoutSeparator;
}
diff --git
a/agents-common/src/main/java/org/apache/ranger/plugin/resourcematcher/RangerURLResourceMatcher.java
b/agents-common/src/main/java/org/apache/ranger/plugin/resourcematcher/RangerURLResourceMatcher.java
index 2c796f03b..751ce68b4 100644
---
a/agents-common/src/main/java/org/apache/ranger/plugin/resourcematcher/RangerURLResourceMatcher.java
+++
b/agents-common/src/main/java/org/apache/ranger/plugin/resourcematcher/RangerURLResourceMatcher.java
@@ -268,13 +268,21 @@ int getPriority() {
}
abstract static class RecursiveMatcher extends
AbstractStringResourceMatcher {
- final char levelSeparatorChar;
- String valueWithoutSeparator;
- String valueWithSeparator;
+ final char levelSeparatorChar;
+ final String valueWithoutSeparator;
+ final String valueWithSeparator;
RecursiveMatcher(String value, Map<String, String> options, char
levelSeparatorChar) {
super(value, options);
this.levelSeparatorChar = levelSeparatorChar;
+
+ if (this.value == null || getNeedsDynamicEval()) {
+ valueWithoutSeparator = null;
+ valueWithSeparator = null;
+ } else {
+ valueWithoutSeparator = getStringToCompare(this.value);
+ valueWithSeparator = valueWithoutSeparator +
levelSeparatorChar;
+ }
}
String getStringToCompare(String policyValue) {
@@ -300,11 +308,6 @@ boolean isMatch(String resourceValue, Map<String, Object>
evalContext) {
noSeparator = expandedPolicyValue != null ?
getStringToCompare(expandedPolicyValue) : null;
} else {
- if (valueWithoutSeparator == null && value != null) {
- valueWithoutSeparator = getStringToCompare(value);
- valueWithSeparator = valueWithoutSeparator +
levelSeparatorChar;
- }
-
noSeparator = valueWithoutSeparator;
}
@@ -343,11 +346,6 @@ boolean isMatch(String resourceValue, Map<String, Object>
evalContext) {
noSeparator = expandedPolicyValue != null ?
getStringToCompare(expandedPolicyValue) : null;
} else {
- if (valueWithoutSeparator == null && value != null) {
- valueWithoutSeparator = getStringToCompare(value);
- valueWithSeparator = valueWithoutSeparator +
levelSeparatorChar;
- }
-
noSeparator = valueWithoutSeparator;
}
