Fang-Yu Rao has posted comments on this change. ( http://gerrit.cloudera.org:8080/24337 )
Change subject: IMPALA-14954: Support ADMIN OPTION clause for GRANT/REVOKE ROLE ...................................................................... Patch Set 11: (1 comment) I have rebased the patch after resolving some conflicts due to https://gerrit.cloudera.org/c/24315/ (IMPALA-14956: Produce Ranger audit events for GRANT/REVOKE ROLE), and addressed Michael's comment on patch set 9 at https://gerrit.cloudera.org/c/24337/9/tests/authorization/test_ranger.py#2461. Let me know if there are additional suggestions. Thanks! http://gerrit.cloudera.org:8080/#/c/24337/9/tests/authorization/test_ranger.py File tests/authorization/test_ranger.py: http://gerrit.cloudera.org:8080/#/c/24337/9/tests/authorization/test_ranger.py@2461 PS9, Line 2461: # becomes false. > Yes. I will try to add such test cases in patch set 11. I have added additional test cases trying to SHOW ROLE GRANT USER/GROUP as a non-admin in patch set 11 after we verified as the user 'getuser()' that its current roles are 'r_1' and 'r_2'. # As the user 'getuser()', verify we could execute SHOW ROLE GRANT USER for # itself. result = user_1_client.execute("show role grant user {}".format(user_1)) TestRanger._check_rows(result, [['r_2', 'false']]) # As the user 'getuser()', verify we could execute SHOW ROLE GRANT GROUP for the # group it belongs to. result = user_1_client.execute("show role grant group {}".format(group_1)) TestRanger._check_rows(result, [['r_1', 'false']]) # As the user 'getuser()', verify we could not execute SHOW ROLE GRANT USER for # another user. result = self.execute_query_expect_failure(user_1_client, "show role grant user {}".format(user_2)) assert "User {} does not have permission for this operation".format(user_1) in \ str(result) # As the user 'getuser()', verify we could not execute SHOW ROLE GRANT GROUP for # another group that 'getuser()' does not belong to. result = self.execute_query_expect_failure(user_1_client, "show role grant group {}".format(group_2)) assert "User {} does not have permission for this operation".format(user_1) in \ str(result) -- To view, visit http://gerrit.cloudera.org:8080/24337 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: I8e7c9ba091bc15271c7a3ef34ca06a38630d5bb6 Gerrit-Change-Number: 24337 Gerrit-PatchSet: 11 Gerrit-Owner: Fang-Yu Rao <[email protected]> Gerrit-Reviewer: Abhishek Rawat <[email protected]> Gerrit-Reviewer: Csaba Ringhofer <[email protected]> Gerrit-Reviewer: Fang-Yu Rao <[email protected]> Gerrit-Reviewer: Impala Public Jenkins <[email protected]> Gerrit-Reviewer: Jason Fehr <[email protected]> Gerrit-Reviewer: Joe McDonnell <[email protected]> Gerrit-Reviewer: Michael Smith <[email protected]> Gerrit-Reviewer: Quanlong Huang <[email protected]> Gerrit-Reviewer: Yida Wu <[email protected]> Gerrit-Comment-Date: Mon, 13 Jul 2026 18:20:44 +0000 Gerrit-HasComments: Yes
