[jira] [Created] (RANGER-5730) Improve nested role import to resolve in-file role dependencies without creating users/groups

["Eoin McDonnell (Jira)" <ji...@apache.org>]

Eoin McDonnell created RANGER-5730:
--------------------------------------

             Summary: Improve nested role import to resolve in-file role dependencies without creating users/groups
                 Key: RANGER-5730
                 URL: https://issues.apache.org/jira/browse/RANGER-5730
             Project: Ranger
          Issue Type: Improvement
          Components: admin
            Reporter: Eoin McDonnell
            Assignee: Eoin McDonnell


When importing roles via RoleREST.importRolesFromFile with createNonExistUserGroupRole=false, import can fail if a role references nested (child) roles that have not been created yet in the same import run.

Example failure:
  "Role with name: <roleName> does not exist"

Setting createNonExistUserGroupRole=true avoids the failure by creating missing referenced roles, but the same flag also creates missing users and groups. That is undesirable for customers who already sync large user/group sets (for example during Unix to LDAP sync-source migration) and do not want Ranger to create unsynced users/groups during role import.

Today there is no option to create missing roles only, and import processes roles in file order without resolving nested-role dependencies within the import payload.

Proposal:
1. Make importRolesFromFile dependency-aware (for example two-pass import): first create/update roles, then apply nested role/user/group memberships once referenced roles from the same file exist.
2. Keep createNonExistUserGroupRole behavior for missing users/groups/roles that are not present in the import file.
3. Add tests for nested role import with createNonExistUserGroupRole=false when all referenced roles are included in the same JSON file.

Primary code areas:
- security-admin/.../RoleREST.java (importRolesFromFile)
- security-admin/.../RoleRefUpdater.java
- security-admin/.../RoleDBStore.java



--
This message was sent by Atlassian Jira
(v8.20.10#820010)