[PR] RANGER-5710: Fix DB access audit search for multi-value requestUser filter [ranger]

["ramackri (via GitHub)" <gi...@apache.org>]

ramackri opened a new pull request, #1115:
URL: https://github.com/apache/ranger/pull/1115

   ## Summary
   
   Fixes Access Audit UI failure when the **Users** filter contains multiple values on the **DB audit path** (`ranger.audit.source.type=db`).
   
   `AssetREST.getAccessLogs()` uses `extractStringList()` for `requestUser` (since RANGER-2394), but `XAccessAuditService` declared the field as `DATA_TYPE.STRING`. `SearchUtil.buildWhereClause()` then throws:
   
   ```
   ClassCastException: java.util.ArrayList cannot be cast to java.lang.String
   ```
   
   Reported during 2.9.0 RC1 validation. Solr audit path already uses `STR_LIST` in `AccessAuditsService`; this aligns the DB path.
   
   **Change:** `requestUser` search field in `XAccessAuditService` → `STR_LIST` (one line).
   
   ## Test plan
   
   - [ ] Set `ranger.audit.source.type=db` in `ranger-admin-site.xml`
   - [ ] `GET /service/assets/accessAudit?requestUser=admin&requestUser=hive&startIndex=0&pageSize=25` → HTTP 200, no ClassCastException in catalina.out
   - [ ] Access Audit UI: Users filter with two values → search succeeds
   - [ ] Single-value `requestUser=admin` regression
   - [ ] Solr audit path regression (`audit_store=solr`)
   
   https://issues.apache.org/jira/browse/RANGER-5710
   
   Made with [Cursor](https://cursor.com)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] RANGER-5710: Fix DB access audit search for multi-value requestUser filter [ranger]

["mneethiraj (via GitHub)" <gi...@apache.org>]

mneethiraj commented on PR #1115:
URL: https://github.com/apache/ranger/pull/1115#issuecomment-5109972510

   @ramackri  - Ranger doesn't support RDBMS as access audit log store since 2.2.0 release (see RANGER-3184), so this code path is a surprise! This code path was taken due to couple of things:
   1. Configuration `ranger.audit.source.type` is not set in `ranger-admin-site.xml`
   2. Default store is still RDBMS (see the following code block)
   
   ```
   class RangerBizUtil {
       String auditDBType = AUDIT_STORE_RDBMS;
   
      ...
   }
   ```
   
   Couple of fixes to address this issue:
   1. Make sure ranger-admin-site.xml in docker setup is set to `solr` or `opensearch`
   3. Change the default in `RangerBizUtil` to `AUDIT_STORE_SOLR`.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] RANGER-5710: Default access audit store to Solr [ranger]

["ramackri (via GitHub)" <gi...@apache.org>]

ramackri merged PR #1115:
URL: https://github.com/apache/ranger/pull/1115


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] RANGER-5710: Default access audit store to Solr [ranger]

["ramackri (via GitHub)" <gi...@apache.org>]

ramackri commented on PR #1115:
URL: https://github.com/apache/ranger/pull/1115#issuecomment-5112079340

   Thanks @mneethiraj — agreed. RDBMS access audit has been deprecated since RANGER-3184; fixing the STR_LIST cast on `XAccessAuditService` was treating a symptom on a path we should not hit.
   
   Updated this PR to your suggested fixes:
   
   1. **`RangerBizUtil`**: default `auditDBType` is now `AUDIT_STORE_SOLR` (was `AUDIT_STORE_RDBMS`)
   2. **`conf.dist/ranger-admin-site.xml`**: default `ranger.audit.source.type` is now `solr` (was `db`)
   3. **Docker Postgres `install.properties`**: `audit_store=solr` with FQDN Solr URLs enabled; OpenSearch block commented out
   
   Removed the `XAccessAuditService` STR_LIST change — with Solr as the default, RC1/docker validation should use the Solr path (`AccessAuditsService`, which already declares `requestUser` as `STR_LIST`).
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org