[jira] [Created] (IMPALA-15341) Preserve the fields of accessType and action in Ranger AuthzAuditEvent for CREATE/DROP and GRANT/REVOKE ROLE operations

["Fang-Yu Rao (Jira)" <ji...@apache.org>]

Fang-Yu Rao created IMPALA-15341:
------------------------------------

             Summary: Preserve the fields of accessType and action in Ranger AuthzAuditEvent for CREATE/DROP and GRANT/REVOKE ROLE operations
                 Key: IMPALA-15341
                 URL: https://issues.apache.org/jira/browse/IMPALA-15341
             Project: IMPALA
          Issue Type: Improvement
          Components: Frontend
            Reporter: Fang-Yu Rao
            Assignee: Fang-Yu Rao


After IMPALA-14956 and IMPALA-15323, Impala produces Ranger audit events for GRANT/REVOKE ROLE and CREATE/DROP ROLE statements. However, as observed in RANGER-5594, the fields of accessType and action in Ranger AuthzAuditEvent are solely determined by the provided accessType.

 

Take CREATE ROLE for instance, the field of 'accessType' will be "CREATE" and the field of 'action' will be "create". According to my current understanding, this is because
 - at [https://github.com/apache/impala/blob/fe5217c/fe/src/main/java/org/apache/impala/authorization/ranger/RangerBufferAuditHandler.java#L132], when constructing the AuthzAuditEvent, we call RangerDefaultAuditHandler#getAuthzEvents() ([https://github.com/apache/ranger/blob/2ad565f/agents-common/src/main/java/org/apache/ranger/plugin/audit/RangerDefaultAuditHandler.java#L102]) that switched the values of these 2 fields ([https://github.com/apache/ranger/blob/2ad565f/agents-common/src/main/java/org/apache/ranger/plugin/audit/RangerDefaultAuditHandler.java#L124] and [https://github.com/apache/ranger/blob/2ad565f/agents-common/src/main/java/org/apache/ranger/plugin/audit/RangerDefaultAuditHandler.java#L127]) (https://issues.apache.org/jira/browse/RANGER-5594 was created for this), and then
 - at [https://github.com/apache/impala/blob/fe5217c/fe/src/main/java/org/apache/impala/authorization/ranger/RangerBufferAuditHandler.java#L140], we uppercase the field of 'accessType' in the AuthzAuditEvent using the value of 'accessType' in the given RangerAccessResult of the method createAuditEvent(RangerAccessResult result).

We observed a similar thing (or issue?) as described above in Apache Hive, but it looks like this was worked around by calling auditEvent.setAccessType(action) at [https://github.com/apache/ranger/blob/2ad565f/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuditHandler.java#L210] in RangerHiveAuditHandler#createAuditEvent().

Before we have a fix for RANGER-5594, it may be good for us to adopt the workaround as well in Impala.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)