vyommani commented on code in PR #1347:
URL: https://github.com/apache/ranger/pull/1347#discussion_r4452269052
##########
security-admin/src/main/java/org/apache/ranger/db/XXServiceDao.java:
##########
@@ -177,7 +179,19 @@ public List<RangerServiceHeaderInfo> findServiceHeaders() {
ret = new ArrayList<>(results.size());
for (Object[] result : results) {
- ret.add(new RangerServiceHeaderInfo((Long) result[0], (String)
result[1], (String) result[2], (String) result[3], (Boolean) result[4]));
+ RangerServiceHeaderInfo svcHeader = new
RangerServiceHeaderInfo((Long) result[0], (String) result[1], (String)
result[2], (String) result[3], (Boolean) result[4]);
+ String adminUsers = (String) result[5];
+ String adminGroups = (String) result[6];
+
+ if (StringUtils.isNotBlank(adminUsers)) {
+
svcHeader.setAdminUsers(Arrays.asList(adminUsers.split(",")));
Review Comment:
Thanks @mneethiraj . Service accounts can download policies, tags, roles,
and the user-store, and call the PDP for other users, so I would not show those
names to every ROLE_USER. service-headers is already returned to that caller,
and service config is hidden from them. Could we fill these fields only when
the caller can already read the service config, and leave them empty otherwise?
That covers admin users without a new permission.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
