[
https://issues.apache.org/jira/browse/RANGER-5709?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Ramachandran Krishnan updated RANGER-5709:
------------------------------------------
Description:
KMS plugin user {{rangerkms}} can download policies and (after fix) roles for
{{{}dev_kms{}}}, but tags and userstore secure download still fail with HTTP
400:
Logged in user is not allowed to read service, name: dev_kms
Root cause is the same across endpoints: for KMS services, some REST handlers
call {{{}svcStore.getServiceByName(){}}}, which enforces service read access
(keyadmin / audit keyadmin only) before checking download allowlists such as
{{{}policy.download.auth.users{}}}, {{{}tag.download.auth.users{}}}, and
{{{}userstore.download.auth.users{}}}.
Policy download already uses {{getServiceByNameForDP()}} for KMS and works.
Roles download was fixed the same way (Madhan issue #4 — validated). Tags and
Userstore still need the same change.
h3. Affected code
||Endpoint||REST class / method||Current lookup||Allowlist config||
|Policy|{{ServiceREST.getSecureServicePoliciesIfUpdated()}}|{{getServiceByNameForDP()}}
✅|{{policy.download.auth.users}}|
|Roles|{{RoleREST.getSecureRangerRolesIfUpdated()}}|{{getServiceByName()}}{{
❌}}|{{policy.download.auth.users}}|
|Tags|{{TagREST.getSecureServiceTagsIfUpdated()}}|{{getServiceByName()}}
❌|{{tag.download.auth.users}}|
|Userstore|{{XUserREST.getSecureRangerUserStoreIfUpdated()}}|{{getServiceByName()}}
❌|{{userstore.download.auth.users}}|
was:
KMS plugin user {{rangerkms}} can download policies and (after fix) roles for
{{{}dev_kms{}}}, but tags and userstore secure download still fail with HTTP
400:
Logged in user is not allowed to read service, name: dev_kms
Root cause is the same across endpoints: for KMS services, some REST handlers
call {{{}svcStore.getServiceByName(){}}}, which enforces service read access
(keyadmin / audit keyadmin only) before checking download allowlists such as
{{{}policy.download.auth.users{}}}, {{{}tag.download.auth.users{}}}, and
{{{}userstore.download.auth.users{}}}.
Policy download already uses {{getServiceByNameForDP()}} for KMS and works.
Roles download was fixed the same way (Madhan issue #4 — validated). Tags and
Userstore still need the same change.
h3. Affected code
||Endpoint||REST class / method||Current lookup||Allowlist config||
|Policy|{{ServiceREST.getSecureServicePoliciesIfUpdated()}}|{{getServiceByNameForDP()}}
✅|{{policy.download.auth.users}}|
|Roles|{{RoleREST.getSecureRangerRolesIfUpdated()}}|{{{}{}}}{{{}getServiceByName(){}}}{{
❌}}|{{policy.download.auth.users}}|
|Tags|{{TagREST.getSecureServiceTagsIfUpdated()}}|{{getServiceByName()}}
❌|{{tag.download.auth.users}}|
|Userstore|{{XUserREST.getSecureRangerUserStoreIfUpdated()}}|{{getServiceByName()}}
❌|{{userstore.download.auth.users}}|
> KMS secure download APIs: align Tags and Userstore with Policy/Roles — use
> getServiceByNameForDP() instead of getServiceByName()
> --------------------------------------------------------------------------------------------------------------------------------
>
> Key: RANGER-5709
> URL: https://issues.apache.org/jira/browse/RANGER-5709
> Project: Ranger
> Issue Type: Task
> Components: Ranger
> Affects Versions: 3.0.0, 2.8.0
> Reporter: Ramachandran Krishnan
> Assignee: Ramachandran Krishnan
> Priority: Major
>
> KMS plugin user {{rangerkms}} can download policies and (after fix) roles for
> {{{}dev_kms{}}}, but tags and userstore secure download still fail with HTTP
> 400:
> Logged in user is not allowed to read service, name: dev_kms
> Root cause is the same across endpoints: for KMS services, some REST handlers
> call {{{}svcStore.getServiceByName(){}}}, which enforces service read access
> (keyadmin / audit keyadmin only) before checking download allowlists such as
> {{{}policy.download.auth.users{}}}, {{{}tag.download.auth.users{}}}, and
> {{{}userstore.download.auth.users{}}}.
> Policy download already uses {{getServiceByNameForDP()}} for KMS and works.
> Roles download was fixed the same way (Madhan issue #4 — validated). Tags and
> Userstore still need the same change.
> h3. Affected code
> ||Endpoint||REST class / method||Current lookup||Allowlist config||
> |Policy|{{ServiceREST.getSecureServicePoliciesIfUpdated()}}|{{getServiceByNameForDP()}}
> ✅|{{policy.download.auth.users}}|
> |Roles|{{RoleREST.getSecureRangerRolesIfUpdated()}}|{{getServiceByName()}}{{
> ❌}}|{{policy.download.auth.users}}|
> |Tags|{{TagREST.getSecureServiceTagsIfUpdated()}}|{{getServiceByName()}}
> ❌|{{tag.download.auth.users}}|
> |Userstore|{{XUserREST.getSecureRangerUserStoreIfUpdated()}}|{{getServiceByName()}}
> ❌|{{userstore.download.auth.users}}|
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
