[
https://issues.apache.org/jira/browse/RANGER-5709?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Ramachandran Krishnan resolved RANGER-5709.
-------------------------------------------
Resolution: Fixed
> KMS secure download APIs: align Tags and Userstore with Policy/Roles — use
> getServiceByNameForDP() instead of getServiceByName()
> --------------------------------------------------------------------------------------------------------------------------------
>
> Key: RANGER-5709
> URL: https://issues.apache.org/jira/browse/RANGER-5709
> Project: Ranger
> Issue Type: Task
> Components: Ranger
> Affects Versions: 3.0.0, 2.8.0
> Reporter: Ramachandran Krishnan
> Assignee: Ramachandran Krishnan
> Priority: Major
> Fix For: 3.0.0, 2.9.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> KMS plugin user {{rangerkms}} can download policies and (after fix) roles for
> {{{}dev_kms{}}}, but tags and userstore secure download still fail with HTTP
> 400:
> Logged in user is not allowed to read service, name: dev_kms
> Root cause is the same across endpoints: for KMS services, some REST handlers
> call {{{}svcStore.getServiceByName(){}}}, which enforces service read access
> (keyadmin / audit keyadmin only) before checking download allowlists such as
> {{{}policy.download.auth.users{}}}, {{{}tag.download.auth.users{}}}, and
> {{{}userstore.download.auth.users{}}}.
> Policy download already uses {{getServiceByNameForDP()}} for KMS and works.
> Roles download was fixed the same way (Madhan issue #4 — validated). Tags and
> Userstore still need the same change.
> h3. Affected code
> ||Endpoint||REST class / method||Current lookup||Allowlist config||
> |Policy|{{ServiceREST.getSecureServicePoliciesIfUpdated()}}|{{getServiceByNameForDP()}}
> ✅|{{policy.download.auth.users}}|
> |Roles|{{RoleREST.getSecureRangerRolesIfUpdated()}}|{{getServiceByName()}}{{
> ❌}}|{{policy.download.auth.users}}|
> |Tags|{{TagREST.getSecureServiceTagsIfUpdated()}}|{{getServiceByName()}}
> ❌|{{tag.download.auth.users}}|
> |Userstore|{{XUserREST.getSecureRangerUserStoreIfUpdated()}}|{{getServiceByName()}}
> ❌|{{userstore.download.auth.users}}|
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
