You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ranger.apache.org by rm...@apache.org on 2026/08/31 23:15:57 UTC
(ranger) branch RANGER-5750-patch created (now d2c1fa8f9)
This is an automated email from the ASF dual-hosted git repository.
rameeshm pushed a change to branch RANGER-5750-patch
in repository https://gitbox.apache.org/repos/asf/ranger.git
at d2c1fa8f9 RANGER-5750:Handle authorization of hbase:acl table in RangerAuthorizationCoprocessor in HBase Ranger plugin
This branch includes the following new commits:
new d2c1fa8f9 RANGER-5750:Handle authorization of hbase:acl table in RangerAuthorizationCoprocessor in HBase Ranger plugin
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(ranger) 01/01: RANGER-5750:Handle authorization of hbase:acl table in RangerAuthorizationCoprocessor in HBase Ranger plugin
Posted by rm...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rameeshm pushed a commit to branch RANGER-5750-patch
in repository https://gitbox.apache.org/repos/asf/ranger.git
commit d2c1fa8f93dc1f72487a85d2128b948a035095e4
Author: Ramesh Mani <rm...@apache.org>
AuthorDate: Mon Aug 31 16:14:36 2026 -0700
RANGER-5750:Handle authorization of hbase:acl table in RangerAuthorizationCoprocessor in HBase Ranger plugin
---
.../hbase/RangerAuthorizationCoprocessor.java | 21 +++++++++++++++++++--
.../hbase/RangerAuthorizationCoprocessorTest.java | 21 ++++++++++++++++++---
2 files changed, 37 insertions(+), 5 deletions(-)
diff --git a/hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessor.java b/hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessor.java
index ffd642613..59698427e 100644
--- a/hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessor.java
+++ b/hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessor.java
@@ -1390,7 +1390,7 @@ boolean canSkipAccessCheck(User user, final String operation, String access, fin
LOG.warn("canSkipAccessCheck: exiting{}", "Unexpeceted: User is null: access denied, not audited!");
throw new AccessDeniedException("No user associated with request (" + operation + ") for action: " + access + "on table:" + table);
- } else if (isAccessForMetadataRead(access, table)) {
+ } else if (isAccessForMetadataRead(access, table, user)) {
LOG.debug("canSkipAccessCheck: true: metadata read access always allowed, not audited");
result = true;
@@ -1434,8 +1434,25 @@ boolean canSkipAccessCheck(User user, final String operation, String access, fin
/* ---- EndpointObserver implementation ---- */
- boolean isAccessForMetadataRead(String access, String table) {
+ boolean isAccessForMetadataRead(String access, String table, User user) {
if (authUtils.isReadAccess(access) && isSpecialTable(table)) {
+ if (StringUtils.equals(table, "hbase:acl")) {
+ boolean isSystemOrSuperUser = false;
+ try {
+ User currentUser = User.getCurrent();
+ if (currentUser != null && user != null) {
+ isSystemOrSuperUser = Objects.equals(currentUser.getShortName(), user.getShortName());
+ }
+ } catch (IOException e) {
+ LOG.warn("Unable to obtain the current user", e);
+ }
+ if (!isSystemOrSuperUser && user != null) {
+ isSystemOrSuperUser = userUtils.isSuperUser(user);
+ }
+ if (!isSystemOrSuperUser) {
+ return false;
+ }
+ }
LOG.debug("isAccessForMetadataRead: Metadata tables read: access allowed!");
return true;
diff --git a/hbase-agent/src/test/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessorTest.java b/hbase-agent/src/test/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessorTest.java
index 340ac1849..1ce477348 100644
--- a/hbase-agent/src/test/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessorTest.java
+++ b/hbase-agent/src/test/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessorTest.java
@@ -391,12 +391,27 @@ public void test18_requirePermission_region_allowsOrDenies() throws Exception {
}
@Test
- public void test19_isSpecialTable_and_metadataRead() {
+ public void test19_isSpecialTable_and_metadataRead() throws Exception {
RangerAuthorizationCoprocessor cp = new RangerAuthorizationCoprocessor();
Assertions.assertTrue(cp.isSpecialTable("hbase:meta"));
Assertions.assertFalse(cp.isSpecialTable("normal"));
- Assertions.assertTrue(cp.isAccessForMetadataRead("read", "hbase:acl"));
- Assertions.assertFalse(cp.isAccessForMetadataRead("write", "hbase:acl"));
+ Assertions.assertFalse(cp.isAccessForMetadataRead("read", "hbase:acl", null));
+ Assertions.assertFalse(cp.isAccessForMetadataRead("write", "hbase:acl", null));
+
+ // Test for system user bypass on hbase:acl
+ User systemUser = mock(User.class);
+ when(systemUser.getShortName()).thenReturn(User.getCurrent().getShortName());
+ Assertions.assertTrue(cp.isAccessForMetadataRead("read", "hbase:acl", systemUser));
+
+ // Test for super user bypass on hbase:acl
+ User superUser = mock(User.class);
+ when(superUser.getShortName()).thenReturn("some_super_user");
+ HbaseUserUtils userUtils = mock(HbaseUserUtils.class);
+ lenient().when(userUtils.isSuperUser(superUser)).thenReturn(true);
+ Field userUtilsField = RangerAuthorizationCoprocessor.class.getDeclaredField("userUtils");
+ userUtilsField.setAccessible(true);
+ userUtilsField.set(cp, userUtils);
+ Assertions.assertTrue(cp.isAccessForMetadataRead("read", "hbase:acl", superUser));
}
@Test