[jira] [Created] (IMPALA-15190) Allow a role administrator to display the managed roles granted to users and groups

["Fang-Yu Rao (Jira)" <ji...@apache.org>]

Fang-Yu Rao created IMPALA-15190:
------------------------------------

             Summary: Allow a role administrator to display the managed roles granted to users and groups
                 Key: IMPALA-15190
                 URL: https://issues.apache.org/jira/browse/IMPALA-15190
             Project: IMPALA
          Issue Type: Improvement
          Components: Frontend
            Reporter: Fang-Yu Rao


We started supporting {{ADMIN OPTION}} clause for {{{}GRANT{}}}/{{{}REVOKE ROLE{}}} after IMPALA-14954. It may make management of roles easier for a role administrator, if a role administrator is allowed to display its managed roles granted to users and groups.

 

Currently, we use the following at pache/impala/blob/6da4ba8/fe/src/main/java/org/apache/impala/authorization/ranger/RangerImpaladAuthorizationManager.java#L114-L117 to determine whether a requesting user is allowed to display the roles granted to a specified group or user.
{code:java}
      boolean adminOp =
          !(groups.contains(params.getGrant_group())
              || params.getRequesting_user().equals(params.getGrant_user())
              || params.is_show_current_roles);
{code}
 

Specifically, when a) the requesting user does not belong to the specified group, and b) the requesting user is not the specified user, and c) the command is not {{{}SHOW CURRENT ROLES{}}}, we will require the requesting user to be an service administrator (from Ranger's perspective). Such a requirement seems to be a bit too restrictive for {{SHOW ROLE GRANT GROUP <group_name>}} and {{{}SHOW ROLE GRANT USER <user_name>{}}}.

 

It would make role management easier if we relax the requirement above a bit for {{SHOW ROLE GRANT GROUP <group_name>}} and {{{}SHOW ROLE GRANT USER <user_name>{}}}. For instance, we may consider changing the checks to the following.
 - Check whether the requesting user is a) a service administrator, or b) belongs to the group of the specified group, or c) is the specified user. If any one of the above is true, we allow the requesting user to display all the roles granted to the specified principal (either a group or a user).
 - When the requesting user does not satisfy any requirement above, get the list roles of which the requesting user is a role administrator, and the list of all the roles granted to the specified principal. Compute the intersection of the 2 lists, and return the roles in the intersection to the requesting user.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)