Madhan Neethiraj created RANGER-5784:
----------------------------------------
Summary: add RangerAuthorizer.filterResources() API to return
authorized resources
Key: RANGER-5784
URL: https://issues.apache.org/jira/browse/RANGER-5784
Project: Ranger
Issue Type: Improvement
Components: authz-api
Reporter: Madhan Neethiraj
Add a new {{RangerAuthorizer}} method that accepts a user, a list of candidate
resources, and required permissions, and returns only the resources on which
the user has specified permissions. This supports common application flows such
as listing tables/files/topics the user may access without requiring the caller
to invoke {{authorize()}} or {{authorizeMulti()}} per resource and filter
results client-side.
h3. Proposed API:
{code:java}
RangerFilterResourcesResult filterResources(RangerFilterResourcesRequest
request) throws RangerAuthzException;
{code}
{{RangerFilterResourcesRequest}}
||Field||Type||Required||Description||
|{{requestId}}|{{String}}|No|Correlation id for audit/tracing|
|{{user}}|{{RangerUserInfo}}|Yes|User, groups, roles, attributes|
|{{resources}}|{{List<RangerResourceInfo>}}|Yes|Candidate resources to evaluate|
|{{permissions}}|{{Set<String>}}|Yes|Permissions to check (e.g. {{{}select{}}},
{{{}read{}}})|
|{{action}}|{{String}}|No|Audit-only label (same semantics as
{{{}RangerAccessInfo.action{}}})|
|{{context}}|{{RangerAccessContext}}|Yes|Service name/type, access time, client
IP, etc.|
{{}}
{{RangerFilterResourcesResult}}
||Field||Type||Description||
|{{requestId}}|{{String}}|Echo from request|
|{{resources}}|{{List<RangerResourceInfo>}}|Subset of input resources where
user is authorized per {{permissionMatch}}|
h3. Example request
{code:java}
{
"requestId": "4aa68265-34f1-4115-b026-d88dff292669",
"user": { "name": "scott.adams" },
"resources": [
{ "name": "table:db1.tbl1" },
{ "name": "table:db1.tbl2" },
{ "name": "table:db1.tbl3" }
],
"action": "LIST_TABLES",
"permissions": [ "_any" ],
"context": {
"serviceName": "dev_hive",
"accessTime": 1755543894,
"clientIpAddress": "172.16.27.152"
}
}
{code}
h3. Example result
{code:java}
{
"requestId": "4aa68265-34f1-4115-b026-d88dff292669",
"resources": [
{ "name": "table:db1.tbl1" },
{ "name": "table:db1.tbl3" }
]
}
{code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
