You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ranger.apache.org by "Eoin McDonnell (Jira)" <ji...@apache.org> on 2026/08/19 19:59:00 UTC
[jira] [Commented] (RANGER-5730) Improve nested role import to resolve in-file role dependencies without creating users/groups
[ https://issues.apache.org/jira/browse/RANGER-5730?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18106049#comment-18106049 ]
Eoin McDonnell commented on RANGER-5730:
----------------------------------------
PR link: https://github.com/apache/ranger/pull/1142
> Improve nested role import to resolve in-file role dependencies without creating users/groups
> ---------------------------------------------------------------------------------------------
>
> Key: RANGER-5730
> URL: https://issues.apache.org/jira/browse/RANGER-5730
> Project: Ranger
> Issue Type: Improvement
> Components: admin
> Reporter: Eoin McDonnell
> Assignee: Eoin McDonnell
> Priority: Major
>
> When importing roles via RoleREST.importRolesFromFile with createNonExistUserGroupRole=false, import can fail if a role references nested (child) roles that have not been created yet in the same import run.
> Example failure:
> "Role with name: <roleName> does not exist"
> Setting createNonExistUserGroupRole=true avoids the failure by creating missing referenced roles, but the same flag also creates missing users and groups. That is undesirable for customers who already sync large user/group sets (for example during Unix to LDAP sync-source migration) and do not want Ranger to create unsynced users/groups during role import.
> Today there is no option to create missing roles only, and import processes roles in file order without resolving nested-role dependencies within the import payload.
> Proposal:
> 1. For role import (importRolesFromFile), restrict createNonExistUserGroupRole=true
> so it creates missing nested roles only; do not create missing users or groups.
> 2. (Optional) Make import dependency-aware / two-pass so nested roles present in the
> same import file succeed even when createNonExistUserGroupRole=false.
> 3. Add tests covering nested role import without creating users/groups.
> Primary code areas:
> - security-admin/.../RoleREST.java (importRolesFromFile)
> - security-admin/.../RoleRefUpdater.java
> - security-admin/.../RoleDBStore.java
--
This message was sent by Atlassian Jira
(v8.20.10#820010)