Ramachandran Krishnan created RANGER-5709:
---------------------------------------------
Summary: KMS secure download APIs: align Tags and Userstore with
Policy/Roles — use getServiceByNameForDP() instead of getServiceByName()
Key: RANGER-5709
URL: https://issues.apache.org/jira/browse/RANGER-5709
Project: Ranger
Issue Type: Task
Components: Ranger
Affects Versions: 2.8.0, 3.0.0
Reporter: Ramachandran Krishnan
Assignee: Ramachandran Krishnan
KMS plugin user {{rangerkms}} can download policies and (after fix) roles for
{{{}dev_kms{}}}, but tags and userstore secure download still fail with HTTP
400:
Logged in user is not allowed to read service, name: dev_kms
Root cause is the same across endpoints: for KMS services, some REST handlers
call {{{}svcStore.getServiceByName(){}}}, which enforces service read access
(keyadmin / audit keyadmin only) before checking download allowlists such as
{{{}policy.download.auth.users{}}}, {{{}tag.download.auth.users{}}}, and
{{{}userstore.download.auth.users{}}}.
Policy download already uses {{getServiceByNameForDP()}} for KMS and works.
Roles download was fixed the same way (Madhan issue #4 — validated). Tags and
Userstore still need the same change.
h3. Affected code
||Endpoint||REST class / method||Current lookup||Allowlist config||
|Policy|{{ServiceREST.getSecureServicePoliciesIfUpdated()}}|{{getServiceByNameForDP()}}
✅|{{policy.download.auth.users}}|
|Roles|{{RoleREST.getSecureRangerRolesIfUpdated()}}|{{{}{}}}{{{}getServiceByName(){}}}{{
❌}}|{{policy.download.auth.users}}|
|Tags|{{TagREST.getSecureServiceTagsIfUpdated()}}|{{getServiceByName()}}
❌|{{tag.download.auth.users}}|
|Userstore|{{XUserREST.getSecureRangerUserStoreIfUpdated()}}|{{getServiceByName()}}
❌|{{userstore.download.auth.users}}|
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
