[#5180][part-1] improvement(test): Add more integration tests about a…

…ccess control (#5316) ### What changes were proposed in this pull request? 1) Add more integration tests about access control. 2) Fix the can't create a role in authorization plugin with `CREATE_ROLE`, `MANAGE_USERS`. 3) Fix creating a role contains metalake, it won't take effect. ### Why are the changes needed? Fix: #5180 ### Does this PR introduce _any_ user-facing change? No. ### How was this patch tested? Just tests. Co-authored-by: roryqi <roryqi@apache.org>
apache · Oct 28, 2024 · af5e6a9 · af5e6a9
1 parent ff029ce
commit af5e6a9
Show file tree

Hide file tree

Showing 7 changed files with 419 additions and 102 deletions.
diff --git a/authorizations/authorization-ranger/build.gradle.kts b/authorizations/authorization-ranger/build.gradle.kts
@@ -125,6 +125,9 @@ tasks {
 }
 
 tasks.test {
+  doFirst {
+    environment("HADOOP_USER_NAME", "test")
+  }
   dependsOn(":catalogs:catalog-hive:jar", ":catalogs:catalog-hive:runtimeJars")
 
   val skipITs = project.hasProperty("skipITs")

diff --git a/...rc/main/java/org/apache/gravitino/authorization/ranger/RangerAuthorizationHivePlugin.java b/...rc/main/java/org/apache/gravitino/authorization/ranger/RangerAuthorizationHivePlugin.java
@@ -226,6 +226,10 @@ public List<RangerSecurableObject> translatePrivilege(SecurableObject securableO
         .forEach(
             gravitinoPrivilege -> {
               Set<RangerPrivilege> rangerPrivileges = new HashSet<>();
+              // Ignore unsupported privileges
+              if (!privilegesMappingRule().containsKey(gravitinoPrivilege.name())) {
+                return;
+              }
               privilegesMappingRule().get(gravitinoPrivilege.name()).stream()
                   .forEach(
                       rangerPrivilege ->

diff --git a/...er/src/main/java/org/apache/gravitino/authorization/ranger/RangerAuthorizationPlugin.java b/...er/src/main/java/org/apache/gravitino/authorization/ranger/RangerAuthorizationPlugin.java
@@ -681,15 +681,6 @@ public boolean validAuthorizationOperation(List<SecurableObject> securableObject
               securableObject.privileges().stream()
                   .forEach(
                       privilege -> {
-                        if (!allowPrivilegesRule().contains(privilege.name())) {
-                          LOG.error(
-                              "Authorization to ignore privilege({}) on metadata object({})!",
-                              privilege.name(),
-                              securableObject.fullName());
-                          match.set(false);
-                          return;
-                        }
-
                         if (!privilege.canBindTo(securableObject.type())) {
                           LOG.error(
                               "The privilege({}) is not supported for the metadata object({})!",

diff --git a/...g/apache/gravitino/authorization/ranger/integration/test/RangerAuthorizationPluginIT.java b/...g/apache/gravitino/authorization/ranger/integration/test/RangerAuthorizationPluginIT.java
@@ -299,11 +299,11 @@ public void testValidAuthorizationOperation() {
             String.format("catalog.schema"),
             MetadataObject.Type.SCHEMA,
             Lists.newArrayList(Privileges.ReadFileset.allow()));
-    Assertions.assertFalse(
+    Assertions.assertTrue(
         rangerAuthPlugin.validAuthorizationOperation(Arrays.asList(createFilesetInMetalake)));
-    Assertions.assertFalse(
+    Assertions.assertTrue(
         rangerAuthPlugin.validAuthorizationOperation(Arrays.asList(createFilesetInCatalog)));
-    Assertions.assertFalse(
+    Assertions.assertTrue(
         rangerAuthPlugin.validAuthorizationOperation(Arrays.asList(createFilesetInSchema)));
 
     // Ignore the Topic operation
@@ -327,13 +327,13 @@ public void testValidAuthorizationOperation() {
             String.format("catalog.schema.fileset"),
             MetadataObject.Type.FILESET,
             Lists.newArrayList(Privileges.WriteFileset.allow()));
-    Assertions.assertFalse(
+    Assertions.assertTrue(
         rangerAuthPlugin.validAuthorizationOperation(Arrays.asList(writeFilesetInMetalake)));
-    Assertions.assertFalse(
+    Assertions.assertTrue(
         rangerAuthPlugin.validAuthorizationOperation(Arrays.asList(writeFilesetInCatalog)));
-    Assertions.assertFalse(
+    Assertions.assertTrue(
         rangerAuthPlugin.validAuthorizationOperation(Arrays.asList(writeFilesetInScheam)));
-    Assertions.assertFalse(
+    Assertions.assertTrue(
         rangerAuthPlugin.validAuthorizationOperation(Arrays.asList(writeFileset)));
 
     // Ignore the Fileset operation
@@ -357,14 +357,13 @@ public void testValidAuthorizationOperation() {
             String.format("catalog.schema.table"),
             MetadataObject.Type.FILESET,
             Lists.newArrayList(Privileges.ReadFileset.allow()));
-    Assertions.assertFalse(
+    Assertions.assertTrue(
         rangerAuthPlugin.validAuthorizationOperation(Arrays.asList(readFilesetInMetalake)));
-    Assertions.assertFalse(
+    Assertions.assertTrue(
         rangerAuthPlugin.validAuthorizationOperation(Arrays.asList(readFilesetInCatalog)));
-    Assertions.assertFalse(
+    Assertions.assertTrue(
         rangerAuthPlugin.validAuthorizationOperation(Arrays.asList(readFilesetInSchema)));
-    Assertions.assertFalse(
-        rangerAuthPlugin.validAuthorizationOperation(Arrays.asList(readFileset)));
+    Assertions.assertTrue(rangerAuthPlugin.validAuthorizationOperation(Arrays.asList(readFileset)));
 
     // Ignore the Topic operation
     SecurableObject createTopicInMetalake =
@@ -382,11 +381,11 @@ public void testValidAuthorizationOperation() {
             String.format("catalog.schema"),
             MetadataObject.Type.SCHEMA,
             Lists.newArrayList(Privileges.CreateTopic.allow()));
-    Assertions.assertFalse(
+    Assertions.assertTrue(
         rangerAuthPlugin.validAuthorizationOperation(Arrays.asList(createTopicInMetalake)));
-    Assertions.assertFalse(
+    Assertions.assertTrue(
         rangerAuthPlugin.validAuthorizationOperation(Arrays.asList(createTopicInCatalog)));
-    Assertions.assertFalse(
+    Assertions.assertTrue(
         rangerAuthPlugin.validAuthorizationOperation(Arrays.asList(createTopicInSchema)));
 
     SecurableObject produceTopicInMetalake =
@@ -409,13 +408,13 @@ public void testValidAuthorizationOperation() {
             String.format("catalog.schema.fileset"),
             MetadataObject.Type.TOPIC,
             Lists.newArrayList(Privileges.ProduceTopic.allow()));
-    Assertions.assertFalse(
+    Assertions.assertTrue(
         rangerAuthPlugin.validAuthorizationOperation(Arrays.asList(produceTopicInMetalake)));
-    Assertions.assertFalse(
+    Assertions.assertTrue(
         rangerAuthPlugin.validAuthorizationOperation(Arrays.asList(produceTopicInCatalog)));
-    Assertions.assertFalse(
+    Assertions.assertTrue(
         rangerAuthPlugin.validAuthorizationOperation(Arrays.asList(produceTopicInSchema)));
-    Assertions.assertFalse(
+    Assertions.assertTrue(
         rangerAuthPlugin.validAuthorizationOperation(Arrays.asList(produceTopic)));
 
     SecurableObject consumeTopicInMetalake =
@@ -438,13 +437,13 @@ public void testValidAuthorizationOperation() {
             String.format("catalog.schema.topic"),
             MetadataObject.Type.TOPIC,
             Lists.newArrayList(Privileges.ConsumeTopic.allow()));
-    Assertions.assertFalse(
+    Assertions.assertTrue(
         rangerAuthPlugin.validAuthorizationOperation(Arrays.asList(consumeTopicInMetalake)));
-    Assertions.assertFalse(
+    Assertions.assertTrue(
         rangerAuthPlugin.validAuthorizationOperation(Arrays.asList(consumeTopicInCatalog)));
-    Assertions.assertFalse(
+    Assertions.assertTrue(
         rangerAuthPlugin.validAuthorizationOperation(Arrays.asList(consumeTopicInSchema)));
-    Assertions.assertFalse(
+    Assertions.assertTrue(
         rangerAuthPlugin.validAuthorizationOperation(Arrays.asList(consumeTopic)));
   }