Akash Gupta created RANGER-5796:
-----------------------------------
Summary: Concurrent GRANT requests from Impala-shell fail with
MySQL x_policy unique constraint violations (UK_service_signature,
UK_name_service_zone) exposed as raw HTTP 400 errors
Key: RANGER-5796
URL: https://issues.apache.org/jira/browse/RANGER-5796
Project: Ranger
Issue Type: Bug
Components: Ranger
Reporter: Akash Gupta
Fix For: 3.0.0
Ranger Admin's policy creation code path (invoked when Impala sends a GRANT
request requiring a new policy row) is not thread-safe under concurrent
execution.
When multiple GRANT statements execute in parallel, they trigger MySQL Unique
Key constraint violations on the table. Rather than handling these race
conditions gracefully or surfacing a retryable conflict, Ranger Admin
propagates raw JDBC/EclipseLink database stack traces to the REST client as an
{*}HTTP 400 Bad Request{*}.
{*}Sequential execution of the exact same GRANT operations on same resources
and roles succeeds without issue{*}, confirming this is strictly a concurrency
control defect in Ranger Admin.
h3. *Expected Behaviour*
# *Concurrency Control:* Ranger Admin should serialise or merge concurrent
create-policy requests cleanly (returning HTTP 200), or return an actionable
*HTTP 409 Conflict* allowing clients to retry.
# *Unique Naming:* Policy name generation must use thread-safe unique
identifiers (e.g., UUIDs or sequence numbers) rather than
millisecond-resolution timestamps.
# *Abstraction:* Internal database implementation details (EclipseLink,
x_policy, JDBC types, MySQL 1062 codes) must never cross the REST API boundary.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
