[IMPALA-12554] Create only one Ranger policy for GRANT statement

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: Impala 4.5.0
• Target Version: Impala 4.5.0
• Epic Color: ghx-label-6
• Assignee: Fang-Yu Rao
• Reporter: Fang-Yu Rao
• Created: 10/Nov/23 17:44
• Updated: 08/Nov/24 19:30
• Resolved: 08/Nov/24 19:30

Description

Currently Impala would create a Ranger policy for each column specified in a GRANT statement. For instance, after the following query, 3 Ranger policies would be created on the Ranger server. This could result in a lot of policies created when there are many columns specified and it may result in Impala's Ranger plug-in taking a long time to download the policies from the Ranger server. It would be great if Impala only creates one single policy for columns in the same table.

[localhost:21050] default> grant select(id, bool_col, tinyint_col) on table functional.alltypes to user non_owner;
Query: grant select(id, bool_col, tinyint_col) on table functional.alltypes to user non_owner
Query submitted at: 2023-11-10 09:38:58 (Coordinator: http://fangyu:25000)
Query progress can be monitored at: http://fangyu:25000/query_plan?query_id=bc4fa1cdefe5881b:413d9a6900000000
+---------------------------------+
| summary                         |
+---------------------------------+
| Privilege(s) have been granted. |
+---------------------------------+
Fetched 1 row(s) in 0.67s

Issue Links

• requires: RANGER-4638 Multiple Columns Revoke not generating policies with correct number of columns
• requires: RANGER-4585 Support multiple columns policy creation in ranger for Grant / Revoke request