Fang-Yu Rao has posted comments on this change. ( http://gerrit.cloudera.org:8080/24337 )
Change subject: IMPALA-14954: Support ADMIN OPTION clause for GRANT/REVOKE ROLE ...................................................................... Patch Set 9: (5 comments) I addressed most of the comments from Michael on patch set 9. I will address the comment at https://gerrit.cloudera.org/c/24337/9/tests/authorization/test_ranger.py#2461 in patch set 11. http://gerrit.cloudera.org:8080/#/c/24337/9/fe/src/main/java/org/apache/impala/authorization/ranger/RangerImpaladAuthorizationManager.java File fe/src/main/java/org/apache/impala/authorization/ranger/RangerImpaladAuthorizationManager.java: http://gerrit.cloudera.org:8080/#/c/24337/9/fe/src/main/java/org/apache/impala/authorization/ranger/RangerImpaladAuthorizationManager.java@147 PS9, Line 147: LOG.error("Error executing SHOW ROLES."); > Not related, but I'm not sure why the exception e is omitted here. We missed it at https://gerrit.cloudera.org/c/16837/14/fe/src/main/java/org/apache/impala/authorization/ranger/RangerImpaladAuthorizationManager.java#155. I will change this to the following in the next patch. LOG.error("Error executing SHOW ROLES.", e); http://gerrit.cloudera.org:8080/#/c/24337/9/fe/src/main/java/org/apache/impala/authorization/ranger/RangerImpaladAuthorizationManager.java@205 PS9, Line 205: LOG.error("Error executing SHOW ROLE GRANT GROUP " + params.getGrant_group() + > Would be better to use slf4j substitution here. Should we also include the Thanks for pointing this out! I will change this to the following in the next patch. LOG.error("Error executing SHOW ROLE GRANT GROUP {}.", params.getGrant_group(), e); http://gerrit.cloudera.org:8080/#/c/24337/9/fe/src/main/java/org/apache/impala/authorization/ranger/RangerImpaladAuthorizationManager.java@210 PS9, Line 210: LOG.error("Error executing SHOW ROLE GRANT USER " + params.getGrant_user() + > And here. I will change this to the following in the next patch. LOG.error("Error executing SHOW ROLE GRANT USER {}.", params.getGrant_user(), e); http://gerrit.cloudera.org:8080/#/c/24337/9/fe/src/main/java/org/apache/impala/service/Frontend.java File fe/src/main/java/org/apache/impala/service/Frontend.java: http://gerrit.cloudera.org:8080/#/c/24337/9/fe/src/main/java/org/apache/impala/service/Frontend.java@896 PS9, Line 896: new TColumn("role_name", Type.STRING.toThrift()))); > Are you specifically omitting grant_option here? Yes. It looks like the schema would be overridden by the following in https://gerrit.cloudera.org/c/24337/9/fe/src/main/java/org/apache/impala/authorization/ranger/RangerImpaladAuthorizationManager.java. /** * This method will be called for the statements of * 1) SHOW ROLE GRANT GROUP <group_name>, 2) SHOW ROLE GRANT USER <user_name>. */ @Override public TResultSet getPrincipalRoles(TShowRolesParams params) throws ImpalaException { TResultSet result = new TResultSet(); TResultSetMetadata schema = new TResultSetMetadata(); schema.addToColumns(new TColumn("role_name", Type.STRING.toThrift())); schema.addToColumns(new TColumn("grant_option", Type.BOOLEAN.toThrift())); ... } We still have to set a non-null 'columns' here. Otherwise, TResultSetMetadata#validate() would throw an exception during the execution of serializer.serialize(result) (https://github.com/apache/impala/blob/e2c226c/fe/src/main/java/org/apache/impala/service/JniFrontend.java#L190) in JniFrontend#createExecRequest(). So I will change this to the following in the next patch. metadata.setColumns(Collections.emptyList()); http://gerrit.cloudera.org:8080/#/c/24337/9/tests/authorization/test_ranger.py File tests/authorization/test_ranger.py: http://gerrit.cloudera.org:8080/#/c/24337/9/tests/authorization/test_ranger.py@2461 PS9, Line 2461: # Verify that the user 'getuser()' is associated with the role 'r_2'. > Can we add a test trying to SHOW ROLE GRANT USER for a different user as a Yes. I will try to add such test cases in patch set 11. -- To view, visit http://gerrit.cloudera.org:8080/24337 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: I8e7c9ba091bc15271c7a3ef34ca06a38630d5bb6 Gerrit-Change-Number: 24337 Gerrit-PatchSet: 9 Gerrit-Owner: Fang-Yu Rao <[email protected]> Gerrit-Reviewer: Abhishek Rawat <[email protected]> Gerrit-Reviewer: Csaba Ringhofer <[email protected]> Gerrit-Reviewer: Fang-Yu Rao <[email protected]> Gerrit-Reviewer: Impala Public Jenkins <[email protected]> Gerrit-Reviewer: Jason Fehr <[email protected]> Gerrit-Reviewer: Joe McDonnell <[email protected]> Gerrit-Reviewer: Michael Smith <[email protected]> Gerrit-Reviewer: Quanlong Huang <[email protected]> Gerrit-Reviewer: Yida Wu <[email protected]> Gerrit-Comment-Date: Sat, 11 Jul 2026 00:45:47 +0000 Gerrit-HasComments: Yes
