[RANGER-4146] [Ranger UI] [React JS] Tag-based policy UI to not show permissions in deny/exception for services that don't support deny/exception

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.0.0
• Component/s: Ranger
• Labels: ranger-react
• Assignee: Brijesh Bhalala
• Reporter: Dhaval Rajpara
• Created: 23/Mar/23 05:13
• Updated: 04/Apr/23 06:22
• Resolved: 04/Apr/23 06:21

Description

Ranger provides service-def option enableDenyAndExceptionsInPolicies to support services where explicit deny and expception are not feasible - for example services like Elasticsearch, Kylin, Nifi-Registry, Nifi, Sqoop. For such services, policy UI shows only allow policy items in resource-based policies. However, tag-based policies are common across all service-types, hence deny and exception policy-items are shown in policy UI. This allows users to setup tag-based policies to deny access to users/group/roles - even though they may not work for above services.

To eliminate confusion, tag-based policy UI should not show permissions in deny and expception policy-items for service-types that don’t support deny and exceptions i.e., service-defs having options.enableDenyAndExceptionsInPolicies=false.

Issue Links

• links to: Apache Review Request