[RANGER-3586] Script condition expression to support csv of group/tag attributes

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.0.0, 2.3.0
• Component/s: plugins
• Assignee: Madhan Neethiraj
• Reporter: Madhan Neethiraj
• Created: 16/Jan/22 05:50
• Updated: 15/Feb/22 22:03
• Resolved: 20/Jan/22 18:17

Description

One of the common row-filter requirement is to enable users access to records with a column having one of a set of values - for example:

projectId in (10, 15)

where projectId could be an attribute associated with groups the user belongs to, or attribute of tags associated with the resource being accessed.

To enable above, expressions that return comma-separated-value of group/tag attributes should be supported - for example: 

projectId in (${{ctx.ugAttrCsv('projectId')}})

 

Issue Links

• is related to: RANGER-3550 support for using user/tag attributes in row-filter expressions and conditions
• is related to: RANGER-3567 support for use of user attributes in policy resources
• relates to: RANGER-3605 Support macros in row-filter/condition expressions
• relates to: RANGER-3609 option to add usergroup enricher automatically based on references in policies