morningman commented on PR #68203: URL: https://github.com/apache/doris/pull/68203#issuecomment-5741840139
Thanks for tracking this down. I reproduced the scenario against the `docker/thirdparties` Ranger (Admin 2.4.0): with policies written against a group only, a member is denied everything down to `SHOW DATABASES` and `SWITCH`, and a **deny** written against a group is silently ignored while a user-level allow on the same table still admits the user. Pointing operators at `ranger.plugin.doris.use.rangerGroups=true` does work on master (plugin library 2.8.0 - I verified access, row filter and mask all apply once it is set), but it cannot be the fix: - branch-3.0 / 2.1 ship `ranger-plugins-common` 2.4.0, which has neither `RangerPluginConfig.isUseRangerGroups()` nor `RangerDefaultRequestProcessor.updateUserGroups()` - the property is a no-op there, and the user store being downloaded (via the enricher) changes nothing without that code; - a group item that Ranger shows as in force but Doris never evaluates is a bug, not a default anyone opted into - the deny half of it is a security hole. So I opened #68220, which makes the two Ranger sources read the user's groups out of the Ranger user store themselves (the same store `use.rangerGroups` reads, so it does not depend on the Ranger version), on by default, with `ranger.plugin.doris.use.rangerGroups=false` as the opt-out, plus a regression suite (`ranger_p2/test_ranger_group_policy`) covering allow / row filter / mask / deny by group and leaving the group. Your report and analysis are referenced there. I would rather land that than document the workaround; feel free to review it. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
