[
https://issues.apache.org/jira/browse/RANGER-5794?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Rakesh Gupta updated RANGER-5794:
---------------------------------
Description:
*Problem:*
After RANGER-4805, Atlas permissions ({{{}atlas:read{}}}, etc.) can still
appear in tag policies and in {{{}x_access_type_def{}}}, especially after
RANGER-3491 changed the service-definition bootstrap flow.
*Cause:*
The {{enableTagBasedPolicies}} check was only present in
{{{}updateTagServiceDefForAccessTypes(){}}}, which is no longer called from the
production code. The actual sync path ({{{}postCreate{}}} / {{postUpdate}} →
{{{}updateTagServiceDefForUpdatingAccessTypes(){}}}) did not have this check,
allowing Atlas permissions to be synced into the tag service-definition.
was:
*Problem:*
After RANGER-4805, Atlas permissions ({{{}atlas:read{}}}, etc.) can still
appear in tag policies and in {{{}x_access_type_def{}}}, especially after
RANGER-3491 changed the service-definition bootstrap flow.
*Cause:*
The {{enableTagBasedPolicies}} check was only present in
{{{}updateTagServiceDefForAccessTypes(){}}}, which is no longer called from the
production code. The actual sync path ({{{}postCreate{}}} / {{postUpdate}} →
{{{}updateTagServiceDefForUpdatingAccessTypes(){}}}) did not have this check,
allowing Atlas permissions to be synced into the tag service-definition.
*Fix:*
Add the {{enableTagBasedPolicies}} check to
{{updateTagServiceDefForUpdatingAccessTypes()}} so that Atlas permissions are
skipped when tag-based policies are disabled.
> Atlas permissions reappear in tag policies when enableTagBasedPolicies is
> disabled
> ----------------------------------------------------------------------------------
>
> Key: RANGER-5794
> URL: https://issues.apache.org/jira/browse/RANGER-5794
> Project: Ranger
> Issue Type: Bug
> Components: Ranger
> Reporter: Rakesh Gupta
> Assignee: Rakesh Gupta
> Priority: Major
>
> *Problem:*
> After RANGER-4805, Atlas permissions ({{{}atlas:read{}}}, etc.) can still
> appear in tag policies and in {{{}x_access_type_def{}}}, especially after
> RANGER-3491 changed the service-definition bootstrap flow.
> *Cause:*
> The {{enableTagBasedPolicies}} check was only present in
> {{{}updateTagServiceDefForAccessTypes(){}}}, which is no longer called from
> the production code. The actual sync path ({{{}postCreate{}}} /
> {{postUpdate}} → {{{}updateTagServiceDefForUpdatingAccessTypes(){}}}) did not
> have this check, allowing Atlas permissions to be synced into the tag
> service-definition.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
