ramackri opened a new pull request, #1114: URL: https://github.com/apache/ranger/pull/1114
## Summary KMS plugin users (e.g. `rangerkms`) hit HTTP 400 on secure **roles**, **tags**, and **userstore** download because those endpoints called `getServiceByName()`, which requires keyadmin to read a KMS service—before the download allowlist is checked. Policy download already uses `getServiceByNameForDP()` for KMS. This change applies the same pattern to: - `RoleREST.getSecureRangerRolesIfUpdated()` → `policy.download.auth.users` - `TagREST.getSecureServiceTagsIfUpdated()` → `tag.download.auth.users` - `XUserREST.getSecureRangerUserStoreIfUpdated()` → `userstore.download.auth.users` ## Test plan - [x] `TestTagREST` secure download (incl. KMS paths) - [x] `TestRoleREST` secure roles download - [x] `TestXUserREST#test142` - [x] PMD clean on `security-admin` https://issues.apache.org/jira/browse/RANGER-5709 Made with [Cursor](https://cursor.com) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
