Re: [PR] RANGER-5750:Handle authorization of hbase:acl table in RangerAuthorizationCoprocessor in HBase Ranger plugin [ranger]

["kumaab (via GitHub)" <gi...@apache.org>]

kumaab commented on code in PR #1201:
URL: https://github.com/apache/ranger/pull/1201#discussion_r4007884076


##########
hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessor.java:
##########
@@ -1434,8 +1434,25 @@ boolean canSkipAccessCheck(User user, final String operation, String access, fin
 
     /* ---- EndpointObserver implementation ---- */
 
-    boolean isAccessForMetadataRead(String access, String table) {
+    boolean isAccessForMetadataRead(String access, String table, User user) {
         if (authUtils.isReadAccess(access) && isSpecialTable(table)) {
+            if (StringUtils.equals(table, "hbase:acl")) {
+                boolean isSystemOrSuperUser = false;
+                try {
+                    User currentUser = User.getCurrent();
+                    if (currentUser != null && user != null) {
+                        isSystemOrSuperUser = Objects.equals(currentUser.getShortName(), user.getShortName());
+                    }
+                } catch (IOException e) {
+                    LOG.warn("Unable to obtain the current user", e);
+                }
+                if (!isSystemOrSuperUser && user != null) {
+                    isSystemOrSuperUser = userUtils.isSuperUser(user);
+                }
+                if (!isSystemOrSuperUser) {
+                    return false;
+                }
+            }
             LOG.debug("isAccessForMetadataRead: Metadata tables read: access allowed!");

Review Comment:
   debug could be updated to also log when the access is not allowed.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org