[IMPALA-10712] SET OWNER ROLE <role_name> of a database/table/view is not supported when Ranger is the authorization provider

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: Impala 4.0.0
• Epic Color: ghx-label-6
• Assignee: Fang-Yu Rao
• Reporter: Fang-Yu Rao
• Created: 21/May/21 00:19
• Updated: 13/Oct/23 20:03

Description

We found that SET OWNER ROLE of a database, table, or a view is not supported when Ranger is the authorization provider.

In the case of set the owner of a database to a given role, when Ranger is the authorization provider, we found that after executing ALTER DATABASE <database_name> SET OWNER ROLE <role_name>, we will hit the non-null check for the given role at https://github.com/apache/impala/blob/master/fe/src/main/java/org/apache/impala/analysis/AlterDbSetOwnerStmt.java#L59 due to the fact that the AuthorizationPolicy returned from getAuthPolicy() does not cache any policy-related information if the authorization provider is Ranger, which is different than the case when Sentry was the authorization provider.

When Ranger is the authorization provider, the currently existing roles are cached by RangerImpalaPlugin. Therefore to address the issue above, we could probably invoke getRoles().getRangerRoles() provided by the RangerImpalaPlugin to retrieve the set of existing roles, similar to what is done at https://github.com/apache/impala/blob/master/fe/src/main/java/org/apache/impala/authorization/ranger/RangerImpaladAuthorizationManager.java#L135.

Tagged joemcdonnell and shajini since I realized this when reviewing Joe's comment at https://gerrit.cloudera.org/c/17469/1/docs/topics/impala_alter_database.xml#b68.

Issue Links

• is duplicated by: IMPALA-12398 Ranger role not exists when altering db/table/view owner to a role