[
https://issues.apache.org/jira/browse/IMPALA-15190?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Fang-Yu Rao updated IMPALA-15190:
---------------------------------
Attachment: 0001-IMPALA-15190-WIP-Allow-role-admin-to-display-its-man.patch
> Allow a role administrator to display the managed roles granted to users and
> groups
> -----------------------------------------------------------------------------------
>
> Key: IMPALA-15190
> URL: https://issues.apache.org/jira/browse/IMPALA-15190
> Project: IMPALA
> Issue Type: Improvement
> Components: Frontend
> Reporter: Fang-Yu Rao
> Priority: Minor
> Attachments:
> 0001-IMPALA-15190-WIP-Allow-role-admin-to-display-its-man.patch
>
>
> We started supporting {{ADMIN OPTION}} clause for {{{}GRANT{}}}/{{{}REVOKE
> ROLE{}}} after IMPALA-14954. It may make management of roles easier for a
> role administrator, if a role administrator is allowed to display its managed
> roles granted to users and groups.
>
> Currently, we use the following at
> pache/impala/blob/6da4ba8/fe/src/main/java/org/apache/impala/authorization/ranger/RangerImpaladAuthorizationManager.java#L114-L117
> to determine whether a requesting user is allowed to display the roles
> granted to a specified group or user.
> {code:java}
> boolean adminOp =
> !(groups.contains(params.getGrant_group())
> || params.getRequesting_user().equals(params.getGrant_user())
> || params.is_show_current_roles);
> {code}
>
> Specifically, when a) the requesting user does not belong to the specified
> group, and b) the requesting user is not the specified user, and c) the
> command is not {{{}SHOW CURRENT ROLES{}}}, we will require the requesting
> user to be an service administrator (from Ranger's perspective). Such a
> requirement seems to be a bit too restrictive for {{SHOW ROLE GRANT GROUP
> <group_name>}} and {{{}SHOW ROLE GRANT USER <user_name>{}}}.
>
> It would make role management easier if we relax the requirement above a bit
> for {{SHOW ROLE GRANT GROUP <group_name>}} and {{{}SHOW ROLE GRANT USER
> <user_name>{}}}. For instance, we may consider changing the checks to the
> following.
> - Check whether the requesting user is a) a service administrator, or b)
> belongs to the group of the specified group, or c) is the specified user. If
> any one of the above is true, we allow the requesting user to display all the
> roles granted to the specified principal (either a group or a user).
> - When the requesting user does not satisfy any requirement above, get the
> list roles of which the requesting user is a role administrator, and the list
> of all the roles granted to the specified principal. Compute the intersection
> of the 2 lists, and return the roles in the intersection to the requesting
> user.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
