mneethiraj commented on code in PR #1324:
URL: https://github.com/apache/ranger/pull/1324#discussion_r4374181386
##########
security-admin/src/main/java/org/apache/ranger/rest/RoleREST.java:
##########
@@ -1678,19 +1674,75 @@ private Set<String> getRoleNames(RangerRole role) {
return rolenames;
}
+ /*
+ * Adds names of all roles nested, directly or transitively, under the
given role. Iterative with a visited
+ * set: each role is loaded at most once and a cyclic role graph
terminates instead of overflowing the stack.
+ */
private void getRoleMemberNames(Set<String> roleMembers, RangerRole role)
throws Exception {
- for (RangerRole.RoleMember roleMember : role.getRoles()) {
- roleMembers.add(roleMember.getName());
+ Deque<RangerRole> pending = new ArrayDeque<>();
+
+ pending.add(role);
+
+ while (!pending.isEmpty()) {
+ RangerRole current = pending.poll();
+
+ for (RangerRole.RoleMember roleMember : current.getRoles()) {
+ if (roleMembers.add(roleMember.getName())) {
+ RangerRole memberRole =
getNestedRoleIfExists(roleMember.getName());
+
+ if (memberRole != null) {
+ pending.add(memberRole);
+ }
+ }
+ }
+ }
+ }
+
+ /*
+ * Adds all role members nested, directly or transitively, under the given
role, and returns the nested roles
+ * loaded along the way (by name). Iterative: each nested role is loaded
at most once, so a cyclic role graph
+ * terminates instead of overflowing the stack.
+ */
+ private Map<String, RangerRole> getRoleMembers(Set<RangerRole.RoleMember>
roleMembers, RangerRole role) throws Exception {
+ Map<String, RangerRole> loaded = new HashMap<>();
+ Deque<RangerRole> pending = new ArrayDeque<>();
+
+ pending.add(role);
+
+ while (!pending.isEmpty()) {
+ RangerRole current = pending.poll();
+
+ for (RangerRole.RoleMember roleMember : current.getRoles()) {
+ roleMembers.add(roleMember);
+
+ if (!loaded.containsKey(roleMember.getName())) {
+ RangerRole memberRole =
getNestedRoleIfExists(roleMember.getName());
- getRoleMemberNames(roleMembers,
roleStore.getRole(roleMember.getName()));
+ loaded.put(roleMember.getName(), memberRole);
+
+ if (memberRole != null) {
+ pending.add(memberRole);
+ }
+ }
+ }
}
+
+ return loaded;
}
- private void getRoleMembers(Set<RangerRole.RoleMember> roleMembers,
RangerRole role) throws Exception {
- for (RangerRole.RoleMember roleMember : role.getRoles()) {
- roleMembers.add(roleMember);
+ /*
+ * A nested role named in a stored role definition may not exist yet, e.g.
when it is created after commit by
+ * createNonExistUserGroupRole. Skip it instead of failing the whole read.
+ * RoleDBStore.getRole(String) throws WebApplicationException only when
the role is not found (by name, or by id
+ * in roleService.read() if deleted in between); DB failures surface as
persistence exceptions and still propagate.
+ */
+ private RangerRole getNestedRoleIfExists(String roleName) {
Review Comment:
`getNestedRoleIfExists()` => `getRoleIfExists()` - as this method is not
about nested roles. Please update the log message in line 1743 as well.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
