Uploaded image for project: 'IMPALA'
  1. IMPALA
  2. IMPALA-12398

Ranger role not exists when altering db/table/view owner to a role

    XMLWordPrintableJSON

Details

    • Bug
    • Status: Resolved
    • Critical
    • Resolution: Fixed
    • None
    • Impala 4.4.0
    • Security
    • ghx-label-14

    Description

      To reproduce the issue, start Impala cluster with Ranger authorization enabled:

      bin/start-impala-cluster.py --impalad_args="--server-name=server1 --ranger_service_type=hive --ranger_app_id=impala --authorization_provider=ranger" --catalogd_args="--server-name=server1 --ranger_service_type=hive --ranger_app_id=impala --authorization_provider=ranger"
      

      Create a role "hql_test" and a temp table "tmp_tbl", then set the owner of it to the role:

      $ impala-shell.sh -u admin
      default> create table tmp_tbl(id int);
      default> create role hql_test;
      default> alter table tmp_tbl set owner role hql_test;
      Query: alter table tmp_tbl set owner role hql_test
      ERROR: AnalysisException: Role 'hql_test' does not exist.
      

      However, SHOW ROLES can show the role:

      default> show roles;
      Query: show roles
      +-----------+
      | role_name |
      +-----------+
      | hql_test  |
      +-----------+
      Fetched 1 row(s) in 0.01s
      

      Ranger roles are not loaded in Impala's catalog cache. We should either load them or use RangerPlugin to check existence of a role. Code snipper of the role check:

      if (analyzer.isAuthzEnabled() && owner_.getOwnerType() == TOwnerType.ROLE
          && analyzer.getCatalog().getAuthPolicy().getRole(ownerName) == null) {
        throw new AnalysisException(String.format("Role '%s' does not exist.", ownerName));
      }
      

      https://github.com/apache/impala/blob/08501cef2df16991bbd99656c696b978f08aeebe/fe/src/main/java/org/apache/impala/analysis/AlterTableOrViewSetOwnerStmt.java#L56

      CC fangyurao

      Attachments

        Issue Links

          Activity

            People

              jichen0919@126.com ji.chen
              stigahuang Quanlong Huang
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: