You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ranger.apache.org by "maheshbandal15 (via GitHub)" <gi...@apache.org> on 2026/05/12 15:14:53 UTC
[PR] RANGER-5592: [GDS] Validity Period is not working for dataset policy [ranger]
maheshbandal15 opened a new pull request, #945:
URL: https://github.com/apache/ranger/pull/945
## What changes were proposed in this pull request?
Fixed an issue where the GDS validity period was not enforced for dataset policies. Previously, when a dataset was configured with a validity end date set before the current date, users were still allowed to execute queries (e.g., SELECT) instead of being denied access. The validity period expiration is now correctly evaluated, ensuring that access through dataset policies is denied once the validity period has expired.
## How was this patch tested?
Manual testing is done.
build successful with "mvn clean install"
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5592: [GDS] Validity Period is not working for dataset policy [ranger]
Posted by "maheshbandal15 (via GitHub)" <gi...@apache.org>.
maheshbandal15 merged PR #945:
URL: https://github.com/apache/ranger/pull/945
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5592: [GDS] Validity Period is not working for dataset policy [ranger]
Posted by "maheshbandal15 (via GitHub)" <gi...@apache.org>.
maheshbandal15 commented on code in PR #945:
URL: https://github.com/apache/ranger/pull/945#discussion_r3242856428
##########
agents-common/src/main/java/org/apache/ranger/plugin/policyengine/gds/GdsDatasetEvaluator.java:
##########
@@ -121,7 +123,12 @@ public void evaluate(RangerAccessRequest request, GdsAccessResult result, Collec
RangerAccessRequestUtil.setAccessTypeResults(datasetRequest.getContext(), null);
RangerAccessRequestUtil.setAccessTypeACLResults(datasetRequest.getContext(), null);
- policyEvaluators.forEach(e -> e.evaluate(datasetRequest, datasetResult));
+ policyEvaluators.forEach(e -> {
+ if (!e.isApplicable(accessTime)) {
Review Comment:
Thanks for reviewing. I have addressed the review comment. Kindly review the updated patch.
[RANGER-5597](https://issues.apache.org/jira/browse/RANGER-5597) is created to track required fix in `GdsProjectEvaluator.evaluate()`. Refer https://github.com/apache/ranger/pull/946
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5592: [GDS] Validity Period is not working for dataset policy [ranger]
Posted by "mneethiraj (via GitHub)" <gi...@apache.org>.
mneethiraj commented on code in PR #945:
URL: https://github.com/apache/ranger/pull/945#discussion_r3238188704
##########
agents-common/src/main/java/org/apache/ranger/plugin/policyengine/gds/GdsDatasetEvaluator.java:
##########
@@ -121,7 +123,12 @@ public void evaluate(RangerAccessRequest request, GdsAccessResult result, Collec
RangerAccessRequestUtil.setAccessTypeResults(datasetRequest.getContext(), null);
RangerAccessRequestUtil.setAccessTypeACLResults(datasetRequest.getContext(), null);
- policyEvaluators.forEach(e -> e.evaluate(datasetRequest, datasetResult));
+ policyEvaluators.forEach(e -> {
+ if (!e.isApplicable(accessTime)) {
Review Comment:
For better readability, consider reversing the conition:
```
policyEvaluators.forEach(e -> {
if (e.isApplicable(accessTime)) {
e.evaluate(datasetRequest, datasetResult);
}
});
```
Also, this fix will be needed in `GdsProjectEvaluator.evaluate()` as well.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org