[jira] [Commented] (RANGER-4023) UserStoreEnricher is not enabled if only mask conditon has attribute based expression

["Subhrat Chaudhary (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/RANGER-4023?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17685414#comment-17685414 ] 

Subhrat Chaudhary commented on RANGER-4023:
-------------------------------------------

[Patch submitted to review board|https://reviews.apache.org/r/74298/]

> UserStoreEnricher is not enabled if only mask conditon has attribute based expression
> -------------------------------------------------------------------------------------
>
>                 Key: RANGER-4023
>                 URL: https://issues.apache.org/jira/browse/RANGER-4023
>             Project: Ranger
>          Issue Type: Bug
>          Components: plugins
>            Reporter: Subhrat Chaudhary
>            Assignee: Subhrat Chaudhary
>            Priority: Major
>             Fix For: 3.0.0
>
>
> We added the support for user/attribute based expressions in masking condition in RANGER-3865 . When only the mask condition has an user/group attribute based expression, RangerUserStoreEnricher is not enabled in plugin end.
> Steps to reproduce (for Hive):
>  * Create a resource based access policy:
>  ** Resources: database=testdb, table=employee, column=*
>  ** Allow condition policy item: group=public, permissions=select
>  * Create a masking policy:
>  ** Resources: database=testdb, table=employee, column=salary
>  ** Allow condition policy item: group=public, permissions=select
>  ** *Masking Option= Custom (CASE WHEN id IN (${{{}USER.employee_id{}}}) THEN salary ELSE '0' END)*
>  * Add following attributes to the user jack:
>  ** *employee_id : 1,2*
>  * We have following data in Hive:
>  ** 
> ||id||name||salary||
> |1|john|5600|
> |2|jane|5300|
> |3|jack|6700|
> |4|harry|9500|
>  * When *select * from testdb.employee;* query is executed, the expectation is {*}salary of the employee john and jane should be displayed as it is, while for others it should be 0{*}. In actual result, salary of all the employees is '0'.
>  * In plugin end, the RangerUserstore cache file userstore.json is not created.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)