Uploaded image for project: 'Atlas'
  1. Atlas
  2. ATLAS-3261

Ranger Authorizer for Atlas is not checked for kafka messages

    XMLWordPrintableJSON

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 1.1.0, 2.0.0
    • Fix Version/s: 2.1.0, 3.0.0
    • Component/s: atlas-intg
    • Labels:

      Description

      Atlas can be configured to authorize user actions with Ranger (https://atlas.apache.org/1.1.0/Atlas-Authorization-Ranger-Authorizer.html).

       

      When I use user via REST it works:

      curl -X GET -u testuser:testuser http://localhost:21000/api/atlas/v2/entity/guid/f52151a0-fa08-4eab-b885-ece847a106e0

      {"errorCode":"ATLAS-403-00-001","errorMessage":"testuser is not authorized to perform read entity: guid=f52151a0-fa08-4eab-b885-ece847a106e0"}

       

      When I send lineage to ATLAS_HOOK, I can create lineage successfully:

      2019-06-04 14:01:38,974 2019-06-04T12:01:23.867Z|testuser|NotificationHookConsumer|POST|api/atlas/v2/entity/|200|15119

      In above, I think user is taken from lineage message field user in json.

       

      Of course above is valid if another policy in ranger  (kafka plugin) allows puting messages to ATLAS_HOOK topic. 

       

      But if I have one user (technical account) to produce to kafka and I want to deny access in Atlas based on user from message, atlas ranger authorizer doens't work.

       

       

       

       

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                Unassigned
                Reporter:
                arempter Adam Rempter
              • Votes:
                1 Vote for this issue
                Watchers:
                3 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0h
                  0h
                  Logged:
                  Time Spent - 1.5h
                  1.5h