(ranger) 01/01: RANGER-5750:Handle authorization of hbase:acl table in RangerAuthorizationCoprocessor in HBase Ranger plugin

[rm...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rameeshm pushed a commit to branch RANGER-5750-patch
in repository https://gitbox.apache.org/repos/asf/ranger.git

commit d2c1fa8f93dc1f72487a85d2128b948a035095e4
Author: Ramesh Mani <rm...@apache.org>
AuthorDate: Mon Aug 31 16:14:36 2026 -0700

    RANGER-5750:Handle authorization of hbase:acl table in RangerAuthorizationCoprocessor in HBase Ranger plugin
---
 .../hbase/RangerAuthorizationCoprocessor.java       | 21 +++++++++++++++++++--
 .../hbase/RangerAuthorizationCoprocessorTest.java   | 21 ++++++++++++++++++---
 2 files changed, 37 insertions(+), 5 deletions(-)

diff --git a/hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessor.java b/hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessor.java
index ffd642613..59698427e 100644
--- a/hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessor.java
+++ b/hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessor.java
@@ -1390,7 +1390,7 @@ boolean canSkipAccessCheck(User user, final String operation, String access, fin
             LOG.warn("canSkipAccessCheck: exiting{}", "Unexpeceted: User is null: access denied, not audited!");
 
             throw new AccessDeniedException("No user associated with request (" + operation + ") for action: " + access + "on table:" + table);
-        } else if (isAccessForMetadataRead(access, table)) {
+        } else if (isAccessForMetadataRead(access, table, user)) {
             LOG.debug("canSkipAccessCheck: true: metadata read access always allowed, not audited");
 
             result = true;
@@ -1434,8 +1434,25 @@ boolean canSkipAccessCheck(User user, final String operation, String access, fin
 
     /* ---- EndpointObserver implementation ---- */
 
-    boolean isAccessForMetadataRead(String access, String table) {
+    boolean isAccessForMetadataRead(String access, String table, User user) {
         if (authUtils.isReadAccess(access) && isSpecialTable(table)) {
+            if (StringUtils.equals(table, "hbase:acl")) {
+                boolean isSystemOrSuperUser = false;
+                try {
+                    User currentUser = User.getCurrent();
+                    if (currentUser != null && user != null) {
+                        isSystemOrSuperUser = Objects.equals(currentUser.getShortName(), user.getShortName());
+                    }
+                } catch (IOException e) {
+                    LOG.warn("Unable to obtain the current user", e);
+                }
+                if (!isSystemOrSuperUser && user != null) {
+                    isSystemOrSuperUser = userUtils.isSuperUser(user);
+                }
+                if (!isSystemOrSuperUser) {
+                    return false;
+                }
+            }
             LOG.debug("isAccessForMetadataRead: Metadata tables read: access allowed!");
 
             return true;
diff --git a/hbase-agent/src/test/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessorTest.java b/hbase-agent/src/test/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessorTest.java
index 340ac1849..1ce477348 100644
--- a/hbase-agent/src/test/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessorTest.java
+++ b/hbase-agent/src/test/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessorTest.java
@@ -391,12 +391,27 @@ public void test18_requirePermission_region_allowsOrDenies() throws Exception {
     }
 
     @Test
-    public void test19_isSpecialTable_and_metadataRead() {
+    public void test19_isSpecialTable_and_metadataRead() throws Exception {
         RangerAuthorizationCoprocessor cp = new RangerAuthorizationCoprocessor();
         Assertions.assertTrue(cp.isSpecialTable("hbase:meta"));
         Assertions.assertFalse(cp.isSpecialTable("normal"));
-        Assertions.assertTrue(cp.isAccessForMetadataRead("read", "hbase:acl"));
-        Assertions.assertFalse(cp.isAccessForMetadataRead("write", "hbase:acl"));
+        Assertions.assertFalse(cp.isAccessForMetadataRead("read", "hbase:acl", null));
+        Assertions.assertFalse(cp.isAccessForMetadataRead("write", "hbase:acl", null));
+
+        // Test for system user bypass on hbase:acl
+        User systemUser = mock(User.class);
+        when(systemUser.getShortName()).thenReturn(User.getCurrent().getShortName());
+        Assertions.assertTrue(cp.isAccessForMetadataRead("read", "hbase:acl", systemUser));
+
+        // Test for super user bypass on hbase:acl
+        User superUser = mock(User.class);
+        when(superUser.getShortName()).thenReturn("some_super_user");
+        HbaseUserUtils userUtils = mock(HbaseUserUtils.class);
+        lenient().when(userUtils.isSuperUser(superUser)).thenReturn(true);
+        Field userUtilsField = RangerAuthorizationCoprocessor.class.getDeclaredField("userUtils");
+        userUtilsField.setAccessible(true);
+        userUtilsField.set(cp, userUtils);
+        Assertions.assertTrue(cp.isAccessForMetadataRead("read", "hbase:acl", superUser));
     }
 
     @Test