----------------------------------------------------------- This is an automatically generated e-mail. To reply, visit: https://reviews.apache.org/r/71899/#review222568 -----------------------------------------------------------
agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyEngine.java Lines 77 (patched) <https://reviews.apache.org/r/71899/#comment311683> Please consider if exposing the internals such as pluginContext can be avoided, by providing the required functionality through parameters (such as user-type). agents-common/src/main/java/org/apache/ranger/plugin/util/RangerRolesUtil.java Lines 36 (patched) <https://reviews.apache.org/r/71899/#comment311685> Why is this needed? Authorization request will typically contain only user/groups. Ranger role-names need to be derived only from these two. hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizer.java Lines 3022 (patched) <https://reviews.apache.org/r/71899/#comment311684> Please consider if this API can be provided directly by the Hive plugin. Doing so will help in keeping the plugin internals hidden from the authorizer code. - Abhay Kulkarni On Jan. 27, 2021, 9:19 p.m., Ramesh Mani wrote: > > ----------------------------------------------------------- > This is an automatically generated e-mail. To reply, visit: > https://reviews.apache.org/r/71899/ > ----------------------------------------------------------- > > (Updated Jan. 27, 2021, 9:19 p.m.) > > > Review request for ranger, Don Bosco Durai, Gautam Borad, Abhay Kulkarni, > Madhan Neethiraj, Mehul Parikh, Pradeep Agrawal, Selvamohan Neethiraj, > Sailaja Polavarapu, and Velmurugan Periasamy. > > > Bugs: RANGER-2640 > https://issues.apache.org/jira/browse/RANGER-2640 > > > Repository: ranger > > > Description > ------- > > RANGER-2640:Implement SHOW ROLE GRANT in Hive ranger plugin > > > Diffs > ----- > > > agents-common/src/main/java/org/apache/ranger/authorization/hadoop/config/RangerPluginConfig.java > 7b34f77da > > agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyEngine.java > 71f8daeb5 > > agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyEngineImpl.java > 4e0c98e9e > > agents-common/src/main/java/org/apache/ranger/plugin/service/RangerAuthContext.java > 81b1971a8 > > agents-common/src/main/java/org/apache/ranger/plugin/service/RangerBasePlugin.java > fda57f947 > > agents-common/src/main/java/org/apache/ranger/plugin/util/RangerRolesUtil.java > 0268e2f30 > > hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizer.java > 5bd5c2da4 > > hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizerBase.java > e06f1357f > > > Diff: https://reviews.apache.org/r/71899/diff/2/ > > > Testing > ------- > > - Verified in Local VM. > - Show Role Grant <user|group|role> <principal> implementation. > - Revised that patch to handle the ROLE fetch from plugin instead of getting > it from Ranger admin via rest. > - Introduced service configuration "ranger.plugin.service.admins" to maintain > list of service admin who can run "show role"commands in hive. > - Introduced api isServiceAdmin() in RangerBasePlugin to check if the user is > service admin. This will enable other plugins to use similar service admin > check for any ROLE based command authorization check. > > > Thanks, > > Ramesh Mani > >
