[
https://issues.apache.org/jira/browse/IMPALA-9597?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Fang-Yu Rao resolved IMPALA-9597.
---------------------------------
Resolution: Fixed
Close the JIRA since the fix has been merged.
> Eliminate redundant Ranger audits when a query involves column masking
> ----------------------------------------------------------------------
>
> Key: IMPALA-9597
> URL: https://issues.apache.org/jira/browse/IMPALA-9597
> Project: IMPALA
> Issue Type: Improvement
> Components: Frontend
> Reporter: Fang-Yu Rao
> Assignee: Fang-Yu Rao
> Priority: Major
>
> After IMPALA-9350, Impala is able to produce the corresponding Ranger audits
> when a query involves policies of column masking. However, redundant audit
> events could be produced in some cases.
> For example, currently Impala will always generate audit events for column
> masking even though the requesting user is not granted the necessary
> privilege on the specified resource because
> {{AuthorizationChecker#postAuthorize()}} is always called whether there is an
> {{AuthorizationException}} or not.
> Another example is that if a table occurs several times in a query, we would
> have duplicate audits for the same column involved in a column masking
> policy. Take the following query for example, since the query would result in
> 2 calls to {{SelectStmt#analyze()}} on the same table, given that there is a
> column masking policy for the column of {{string_col}}, we will see 2
> duplicate audit events for this column.
> {noformat}
> with iv as (select id, bool_col, string_col from functional.alltypestiny)
> select * from iv;
> {noformat}
> We should thus eliminate the redundant audits in the cases described above.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
