vyommani commented on code in PR #1347:
URL: https://github.com/apache/ranger/pull/1347#discussion_r4457442034
##########
security-admin/src/main/java/org/apache/ranger/db/XXServiceDao.java:
##########
@@ -177,7 +179,19 @@ public List<RangerServiceHeaderInfo> findServiceHeaders() {
ret = new ArrayList<>(results.size());
for (Object[] result : results) {
- ret.add(new RangerServiceHeaderInfo((Long) result[0], (String)
result[1], (String) result[2], (String) result[3], (Boolean) result[4]));
+ RangerServiceHeaderInfo svcHeader = new
RangerServiceHeaderInfo((Long) result[0], (String) result[1], (String)
result[2], (String) result[3], (Boolean) result[4]);
+ String adminUsers = (String) result[5];
+ String adminGroups = (String) result[6];
+
+ if (StringUtils.isNotBlank(adminUsers)) {
+
svcHeader.setAdminUsers(Arrays.asList(adminUsers.split(",")));
Review Comment:
@mneethiraj , The PDP and audit-server identities are fixed at deploy time,
so a property in ranger-admin-site.xml fits better than a new permission. For
example, ranger.admin.service.header.privileged.users and
ranger.admin.service.header.privileged.groups could be set to
rangerpdp,rangeraudit. In getServiceHeaders(), fill serviceAccountUsers and
serviceAccountGroups only for a sysadmin, an auditor, or a caller on that list.
Everyone else gets those fields empty. That keeps the endpoint unchanged for a
normal user, and it does not grant the Auditor role.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
