[RANGER-3524] Bug in KeyAuthorizationKeyProvider.checkAccess

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Not A Bug
• Affects Version/s: 2.2.0
• Component/s: kms
• Assignee: Unassigned
• Reporter: Huicheng Song
• Created: 23/Nov/21 19:07
• Updated: 13/Jan/23 05:04
• Resolved: 13/Jan/23 05:04

Description

In KMS KeyAuthorizationKeyProvider.checkAccess, it checks whether the ACL is present first for the requested operation.

 

But the code instead check whether ACL is present for operation KeyOpType.MANAGEMENT: https://github.com/apache/ranger/blob/ranger-2.2/kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KeyAuthorizationKeyProvider.java#L154