[jira] [Created] (RANGER-5784) add RangerAuthorizer.filterResources() API to return authorized resources

["Madhan Neethiraj (Jira)" <ji...@apache.org>]

Madhan Neethiraj created RANGER-5784:
----------------------------------------

             Summary: add RangerAuthorizer.filterResources() API to return authorized resources
                 Key: RANGER-5784
                 URL: https://issues.apache.org/jira/browse/RANGER-5784
             Project: Ranger
          Issue Type: Improvement
          Components: authz-api
            Reporter: Madhan Neethiraj


Add a new {{RangerAuthorizer}} method that accepts a user, a list of candidate resources, and required permissions, and returns only the resources on which the user has specified permissions. This supports common application flows such as listing tables/files/topics the user may access without requiring the caller to invoke {{authorize()}} or {{authorizeMulti()}} per resource and filter results client-side.
h3. Proposed API:
{code:java}
RangerFilterResourcesResult filterResources(RangerFilterResourcesRequest request) throws RangerAuthzException;
{code}
 

{{RangerFilterResourcesRequest}}
||Field||Type||Required||Description||
|{{requestId}}|{{String}}|No|Correlation id for audit/tracing|
|{{user}}|{{RangerUserInfo}}|Yes|User, groups, roles, attributes|
|{{resources}}|{{List<RangerResourceInfo>}}|Yes|Candidate resources to evaluate|
|{{permissions}}|{{Set<String>}}|Yes|Permissions to check (e.g. {{{}select{}}}, {{{}read{}}})|
|{{action}}|{{String}}|No|Audit-only label (same semantics as {{{}RangerAccessInfo.action{}}})|
|{{context}}|{{RangerAccessContext}}|Yes|Service name/type, access time, client IP, etc.|

{{}}

{{RangerFilterResourcesResult}}
||Field||Type||Description||
|{{requestId}}|{{String}}|Echo from request|
|{{resources}}|{{List<RangerResourceInfo>}}|Subset of input resources where user is authorized per {{permissionMatch}}|
h3. Example request
{code:java}
{
  "requestId": "4aa68265-34f1-4115-b026-d88dff292669",
  "user":      { "name": "scott.adams" },
  "resources": [
    { "name": "table:db1.tbl1" },
    { "name": "table:db1.tbl2" },
    { "name": "table:db1.tbl3" }
  ],
  "action": "LIST_TABLES",
  "permissions": [ "_any" ],
  "context": {
    "serviceName":     "dev_hive",
    "accessTime":      1755543894,
    "clientIpAddress": "172.16.27.152"
  }
}
{code}
h3. Example result
{code:java}
{
  "requestId": "4aa68265-34f1-4115-b026-d88dff292669",
  "resources": [
    { "name": "table:db1.tbl1" },
    { "name": "table:db1.tbl3" }
  ]
}
{code}



--
This message was sent by Atlassian Jira
(v8.20.10#820010)