Skip to content

RANGER-5595: Audit grant and revoke role operations - #1160

Open
arnabnandy7 wants to merge 1 commit into
apache:masterfrom
arnabnandy7:fix/grant-role-audit
Open

RANGER-5595: Audit grant and revoke role operations#1160
arnabnandy7 wants to merge 1 commit into
apache:masterfrom
arnabnandy7:fix/grant-role-audit

Conversation

@arnabnandy7

Copy link
Copy Markdown

What changes were proposed in this pull request?

This pull request fixes RANGER-5595 by generating audit results for role grant and revoke operations when a non-null RangerAccessResultProcessor is provided.

The changes:

  • Add audit processing to RangerBasePlugin#grantRole() and RangerBasePlugin#revokeRole().
  • Generate audit results for both successful and failed operations.
  • Preserve the existing role audit semantics and request metadata.
  • Remove the Hive authorizer’s manual role audit generation to prevent duplicate audit events.
  • Add focused unit tests covering successful role grants and failed role revocations.

How was this patch tested?

The focused unit tests for role grant and revoke auditing were run with:

mvn -pl agents-common -DskipTests=false -Dtest=TestRangerBasePluginRoleAudit test

Results:

Tests run: 2, Failures: 0, Errors: 0, Skipped: 0
BUILD SUCCESS

The tests verify:

  • Audit result generation for a successful role grant.
  • Denied audit result generation for a failed role revocation.
  • Audit action, access type, global resource, and failure policy ID values.

Signed-off-by: Arnab Nandy <arnab_nandy7@yahoo.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant