[RANGER-3617] incorrect deny for _any access due to tag policy

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.1.0, 2.2.0
• Fix Version/s: 3.0.0, 2.3.0
• Component/s: plugins
• Assignee: Madhan Neethiraj
• Reporter: Madhan Neethiraj
• Created: 11/Feb/22 06:09
• Updated: 28/Jul/22 14:28
• Resolved: 12/Feb/22 07:34

Description

API to check if user has any access within a resource returns deny when a tag-based policy denies access to a child resource, even though another policy allows access to a different child resource. More details to reproduce the issue below:

1. Policy on tag=RESTRICTED denies select access to user2
2. A resource-based policy allows select access to user2 on database=*, table=*, column=*
3. Column finance.tax_2016.name is tagged with RESTRICTED
4. user2 is denied select on this column by above tag-based policy – this is as expected
5. user2 is denied _any on finance database (like "use finance;") by above tag-based policy – which is incorrect
   Expected: access should have been allowed by above resource-based policy

 

Issue Links

• fixes: RANGER-3839 Ranger Tag based policy with ability to show metadata for covered resource
• links to: Patch in review board