[
https://issues.apache.org/jira/browse/RANGER-5730?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18106049#comment-18106049
]
Eoin McDonnell commented on RANGER-5730:
----------------------------------------
PR link: https://github.com/apache/ranger/pull/1142
> Improve nested role import to resolve in-file role dependencies without
> creating users/groups
> ---------------------------------------------------------------------------------------------
>
> Key: RANGER-5730
> URL: https://issues.apache.org/jira/browse/RANGER-5730
> Project: Ranger
> Issue Type: Improvement
> Components: admin
> Reporter: Eoin McDonnell
> Assignee: Eoin McDonnell
> Priority: Major
>
> When importing roles via RoleREST.importRolesFromFile with
> createNonExistUserGroupRole=false, import can fail if a role references
> nested (child) roles that have not been created yet in the same import run.
> Example failure:
> "Role with name: <roleName> does not exist"
> Setting createNonExistUserGroupRole=true avoids the failure by creating
> missing referenced roles, but the same flag also creates missing users and
> groups. That is undesirable for customers who already sync large user/group
> sets (for example during Unix to LDAP sync-source migration) and do not want
> Ranger to create unsynced users/groups during role import.
> Today there is no option to create missing roles only, and import processes
> roles in file order without resolving nested-role dependencies within the
> import payload.
> Proposal:
> 1. For role import (importRolesFromFile), restrict
> createNonExistUserGroupRole=true
> so it creates missing nested roles only; do not create missing users or
> groups.
> 2. (Optional) Make import dependency-aware / two-pass so nested roles present
> in the
> same import file succeed even when createNonExistUserGroupRole=false.
> 3. Add tests covering nested role import without creating users/groups.
> Primary code areas:
> - security-admin/.../RoleREST.java (importRolesFromFile)
> - security-admin/.../RoleRefUpdater.java
> - security-admin/.../RoleDBStore.java
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
