RANGER-5215 : Policy authorisation fails for Ranger Plugins in case of users/groups converted by Ranger userysnc as per given Regex #584

dhavalshah9131 · 2025-06-05T14:41:31Z

What changes were proposed in this pull request?

Problem Statement:

Currently, when Ranger Usersync is configured with case conversion and special character replacement using regex, it transforms the original user/group names from the source (e.g., AD/LDAP) before storing them in the Ranger Admin database.

Example:

Original name in LDAP/AD: John-jacobs
Usersync configuration:

ranger.usersync.ldap.username.caseconversion = lower
ranger.usersync.mapping.username.regex = s/[-]/_/g
Transformed and stored name in Ranger: john_jacobs

Issue:

If a Ranger plugin (e.g., Hive) uses the original name John-jacobs during authorization checks, it fails because Ranger Admin only recognizes the transformed name john_jacobs.

Error Example:

Permission denied: user [John-jacobs] does not have [SELECT] privilege on [vehicle/cars/*]
Solution:

To ensure consistency, the same transformation logic used by Usersync must also be applied on the plugin side before authorization. This transformation should be made available as a utility library packaged with the plugins.

Configurability:

This feature must be configurable at the plugin level via a property (e.g., ranger.plugin..supports.name.transformation), allowing users to enable or disable it based on their environment needs.

In ranger-admin-site.xml

ranger.plugins.ldap.username.caseconversion
ranger.plugins.ldap.groupname.caseconversion
ranger.plugins.mapping.username.handler
ranger.plugins.mapping.groupname.handler
ranger.plugins.mapping.regex.separator
ranger.plugins.mapping.username.regex
ranger.plugins.mapping.groupname.regex

How was this patch tested?

(Please explain how this patch was tested. Ex: unit tests, manual tests)
1.) Build successful with unit test.
2.) Manul testing

agents-common/src/main/java/org/apache/ranger/plugin/service/RangerDefaultRequestProcessor.java

ugsync-util/src/test/java/org/apache/ranger/ugsynutil/transform/TestRegEx.java

agents-common/src/main/java/org/apache/ranger/plugin/model/UgsyncNameTransformRules.java

agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyEngineImpl.java

…f users/groups converted by Ranger userysnc as per given Regex

Copilot

Pull Request Overview

This PR addresses the issue where Ranger plugins fail authorization due to differences in user/group name formatting between the source (e.g., LDAP/AD) and the Ranger Admin database. The changes introduce a shared utility (ugsync-util) and corresponding configuration constants to apply consistent name transformations on the plugin side. Key changes include:

Updating various plugin assembly XML files to include the ugsync-util dependency.
Enhancing the RangerDefaultRequestProcessor and RangerBasePlugin to apply case conversion and regex-based name transformations using a new Mapper instance.
Adding new constants and a model (UgsyncNameTransformRules) to support the name transformation configuration.

Reviewed Changes

Copilot reviewed 41 out of 41 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
distro/src/main/assembly/*.xml	Added for ugsync-util in several plugin and agent assembly definitions.
agents-common/src/main/java/org/apache/ranger/plugin/util/ServicePolicies.java	Updated to copy service configuration including new name transformation settings.
agents-common/src/main/java/org/apache/ranger/plugin/util/RangerCommonConstants.java	Added new constants for name transformation configuration.
agents-common/src/main/java/org/apache/ranger/plugin/service/RangerDefaultRequestProcessor.java	Added logic to perform user and group name transformation based on config settings.
agents-common/src/main/java/org/apache/ranger/plugin/service/RangerBasePlugin.java	Introduced configuration loading for name transformation and Mapper instantiation.
agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPluginContext.java	Added getters and setters for transformation Mapper and case conversion strings.
agents-common/src/main/java/org/apache/ranger/plugin/model/UgsyncNameTransformRules.java	New model to encapsulate name transformation rules.
agents-common/pom.xml	Added dependency on ugsync-util with necessary exclusions.

Comments suppressed due to low confidence (2)

agents-common/src/main/java/org/apache/ranger/plugin/service/RangerBasePlugin.java:1288

Consider using getDeclaredConstructor().newInstance() instead of newInstance() for instantiating the Mapper, to follow modern Java instantiation practices.

Mapper userNameRegExInst = regExClass.newInstance();

agents-common/src/main/java/org/apache/ranger/plugin/service/RangerBasePlugin.java:1308

Consider using getDeclaredConstructor().newInstance() instead of newInstance() for instantiating the Mapper, to follow modern Java instantiation practices.

Mapper groupNameRegExInst = regExClass.newInstance();

…f users/groups converted by Ranger userysnc as per given Regex

security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java

…f users/groups converted by Ranger userysnc as per given Regex

security-admin/src/main/java/org/apache/ranger/common/PropertiesUtil.java

security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java

rameeshm

@dhavalshah9131 Please correct the JIRA description as it has Typo.
RANGER-5215 : Policy authorization fails for Ranger Plugins in case of users/groups converted by Ranger userysnc as per given Regex

…f users/groups converted by Ranger userysnc as per given Regex

agents-common/src/main/java/org/apache/ranger/plugin/service/RangerDefaultRequestProcessor.java

fateh288

I have one more refactoring suggestion, but other than that it looks good

…f users/groups converted by Ranger userysnc as per given Regex

ugsync/src/main/java/org/apache/ranger/unixusersync/config/UserGroupSyncConfig.java

…f users/groups converted by Ranger userysnc as per given Regex

fateh288

LGTM !!

security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java

…f users/groups converted by Ranger userysnc as per given Regex

agents-common/src/main/java/org/apache/ranger/plugin/service/RangerDefaultRequestProcessor.java

agents-common/src/main/java/org/apache/ranger/plugin/service/RangerBasePlugin.java

ugsync-util/src/main/java/org/apache/ranger/ugsyncutil/transform/RegEx.java

…f users/groups converted by Ranger userysnc as per given Regex

ugsync-util/src/main/java/org/apache/ranger/ugsyncutil/transform/RegEx.java

ugsync-util/src/test/java/org/apache/ranger/ugsynutil/transform/TestRegEx.java

security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java

mneethiraj · 2025-07-23T18:52:20Z

security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java

@@ -194,7 +191,8 @@ public class ServiceREST {
    public static final String PURGE_RECORD_TYPE_LOGIN_LOGS         = "login_records";
    public static final String PURGE_RECORD_TYPE_TRX_LOGS           = "trx_records";
    public static final String PURGE_RECORD_TYPE_POLICY_EXPORT_LOGS = "policy_export_logs";
-
+    private static final Logger LOG      = LoggerFactory.getLogger(ServiceREST.class);


To be consistent with rest of the sources, have initialization of Logger instances at the beginning of the class.

Hi @mneethiraj ,

LOG seems to be private. As per steps mentioned RANGER-5018 it gets shfited after public variables.

security-admin/src/main/java/org/apache/ranger/common/RangerServicePoliciesCache.java

security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java

agents-common/src/main/java/org/apache/ranger/plugin/service/RangerBasePlugin.java

agents-common/src/main/java/org/apache/ranger/plugin/model/UgsyncNameTransformRules.java

…f users/groups converted by Ranger userysnc as per given Regex

mneethiraj · 2025-07-25T14:48:09Z

ugsync-util/pom.xml

@@ -47,6 +47,28 @@
            <groupId>com.google.code.gson</groupId>
            <artifactId>gson</artifactId>
        </dependency>
+        <dependency>
+            <groupId>org.apache.logging.log4j</groupId>


Are libraries log4j-api and log4j-over-slf4j needed in ugsync-util module? If not, please remove these dependencies.

mneethiraj · 2025-07-25T14:52:56Z

agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPluginContext.java

@@ -40,6 +41,10 @@ public class RangerPluginContext {
    private final RangerPluginConfig                                                         config;
    private final Map<String, Map<RangerPolicy.RangerPolicyResource, RangerResourceMatcher>> resourceMatchers = new HashMap<>();
    private final ReentrantReadWriteLock                                                     lock             = new ReentrantReadWriteLock(true); // fair lock
+    private       Mapper                                                                     userNameTransformInst;


I suggest moving new members to RangerAuthContext class.

mneethiraj · 2025-07-25T21:55:59Z

ugsync/src/main/java/org/apache/ranger/unixusersync/config/UserGroupSyncConfig.java

@@ -1435,6 +1396,37 @@ public boolean isSyncSourceValidationEnabled() {
        return isSyncSourceValidationEnabled;
    }

+    public Map<String, String> getNameTransformationRules() {


Methods getNameTransformationRules() and getAllRegexPatternsConfig() don't seem to be used. Please review and remove.

mneethiraj · 2025-07-25T22:01:26Z

ugsync-util/src/main/java/org/apache/ranger/ugsyncutil/transform/RegEx.java

@@ -69,7 +62,7 @@ public String transform(String attrValue) {
        return result;
    }

-    protected void populateReplacementPatterns(String baseProperty, List<String> regexPatterns, String regexSeparator) {
+    public void populateReplacementPatterns(String baseProperty, List<String> regexPatterns, String regexSeparator) {


This is referenced from this class, and its test class TestRegEx. I suggest changing visibility to package-private i.e. remove public. Btw, there is a typo in the test class package name: org.apache.ranger.ugsynutil.transform => org.apache.ranger.ugsyncutil.transform (missing c in ugsyncutil).

mneethiraj · 2025-07-25T22:14:37Z

security-admin/src/main/java/org/apache/ranger/common/PropertiesUtil.java

+                LOG.warn("More than one character found in RegEx Separator, using default RegEx Separator");
+            }
+        }
+        LOG.info(String.format("Using %s as the RegEx Separator", ret));


Replace use of String.format with parameterized log message.

mneethiraj · 2025-07-25T22:47:57Z

agents-common/src/main/java/org/apache/ranger/plugin/service/RangerDefaultRequestProcessor.java

+        String user                   = request.getUser();
+        String userNameCaseConversion = policyEngine.getPluginContext().getUserNameCaseConversion();
+
+        if (UgsyncCommonConstants.UGSYNC_LOWER_CASE_CONVERSION_VALUE.equalsIgnoreCase(userNameCaseConversion)) {


Consider avoiding string comparision on every authz call; instead have the configured parsed to a boolean in RangerAuthContext and access boolean from here.

mneethiraj · 2025-07-25T22:48:13Z

agents-common/src/main/java/org/apache/ranger/plugin/service/RangerDefaultRequestProcessor.java

+                .map(group -> {
+                    String originalGroup = group;
+
+                    if (UgsyncCommonConstants.UGSYNC_LOWER_CASE_CONVERSION_VALUE.equalsIgnoreCase(caseConversion)) {


Consider avoiding string comparision on every authz call, and for each group; instead have the configured parsed to a boolean in RangerAuthContext and access boolean from here.

mneethiraj · 2025-07-25T23:05:01Z

agents-common/src/main/java/org/apache/ranger/plugin/service/RangerDefaultRequestProcessor.java

+        Mapper groupNameTransformInst = policyEngine.getPluginContext().getGroupNameTransformInst();
+        String caseConversion         = policyEngine.getPluginContext().getGroupNameCaseConversion();
+
+        if (groupNameTransformInst == null || request.getUserGroups() == null) {


When groupNameTransformInst is null, return at line 202 will result in case-conversion to be not applied. Please review and update.

dhavalshah9131 requested review from Copilot, mneethiraj, pradeepagrawal8184, bhavikpatel9977, kumaab, spolavarpau1, mehulbparikh and dineshkumar-yadav June 5, 2025 14:41

This comment was marked as outdated.

Sign in to view

kumaab reviewed Jun 5, 2025

View reviewed changes

agents-common/src/main/java/org/apache/ranger/plugin/service/RangerDefaultRequestProcessor.java Outdated Show resolved Hide resolved

kumaab reviewed Jun 5, 2025

View reviewed changes

ugsync-util/src/test/java/org/apache/ranger/ugsynutil/transform/TestRegEx.java Outdated Show resolved Hide resolved

kumaab reviewed Jun 5, 2025

View reviewed changes

agents-common/src/main/java/org/apache/ranger/plugin/model/UgsyncNameTransformRules.java Outdated Show resolved Hide resolved

kumaab assigned dhavalshah9131 Jun 5, 2025

rameeshm reviewed Jun 6, 2025

View reviewed changes

agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyEngineImpl.java Outdated Show resolved Hide resolved

agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyEngineImpl.java Outdated Show resolved Hide resolved

dhavalshah9131 added 2 commits June 13, 2025 05:34

RANGER-5215 : Policy authroisation fails for Ranger Plugins in case o…

f969e3e

…f users/groups converted by Ranger userysnc as per given Regex

RANGER-5215 : Policy authroisation fails for Ranger Plugins in case o…

be624fb

…f users/groups converted by Ranger userysnc as per given Regex

dhavalshah9131 force-pushed the ds_RANGER-5215_us branch from 6d46c54 to be624fb Compare June 13, 2025 00:04

dhavalshah9131 requested review from rameeshm, kumaab and Copilot June 13, 2025 00:05

Copilot AI reviewed Jun 13, 2025

View reviewed changes

apache deleted a comment from Copilot AI Jun 16, 2025

dhavalshah9131 and others added 2 commits June 16, 2025 13:09

Merge branch 'master' into ds_RANGER-5215_us

5216966

RANGER-5215 : Policy authroisation fails for Ranger Plugins in case o…

53140c7

…f users/groups converted by Ranger userysnc as per given Regex

fateh288 reviewed Jun 23, 2025

View reviewed changes

security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java Outdated Show resolved Hide resolved

RANGER-5215 : Policy authroisation fails for Ranger Plugins in case o…

8bc7969

…f users/groups converted by Ranger userysnc as per given Regex

dhavalshah9131 requested a review from fateh288 July 14, 2025 15:29

fateh288 requested changes Jul 14, 2025

View reviewed changes

rameeshm reviewed Jul 15, 2025

View reviewed changes

dhavalshah9131 added 2 commits July 15, 2025 13:17

Merge branch 'master' into ds_RANGER-5215_us

3c8c1ad

RANGER-5215 : Policy authorisation fails for Ranger Plugins in case o…

96a6476

…f users/groups converted by Ranger userysnc as per given Regex

dhavalshah9131 requested review from rameeshm and fateh288 July 16, 2025 17:46

fateh288 reviewed Jul 16, 2025

View reviewed changes

agents-common/src/main/java/org/apache/ranger/plugin/service/RangerDefaultRequestProcessor.java Show resolved Hide resolved

fateh288 approved these changes Jul 16, 2025

View reviewed changes

RANGER-5215 : Policy authorisation fails for Ranger Plugins in case o…

ee8dca0

…f users/groups converted by Ranger userysnc as per given Regex

dhavalshah9131 requested a review from fateh288 July 17, 2025 09:57

kumaab reviewed Jul 17, 2025

View reviewed changes

ugsync/src/main/java/org/apache/ranger/unixusersync/config/UserGroupSyncConfig.java Outdated Show resolved Hide resolved

RANGER-5215 : Policy authorisation fails for Ranger Plugins in case o…

b908e67

…f users/groups converted by Ranger userysnc as per given Regex

dhavalshah9131 requested a review from kumaab July 17, 2025 19:15

fateh288 approved these changes Jul 18, 2025

View reviewed changes

kumaab reviewed Jul 18, 2025

View reviewed changes

security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java Show resolved Hide resolved

RANGER-5215 : Policy authorisation fails for Ranger Plugins in case o…

1194e1b

…f users/groups converted by Ranger userysnc as per given Regex

dhavalshah9131 requested a review from kumaab July 22, 2025 19:05

kumaab approved these changes Jul 23, 2025

View reviewed changes

RANGER-5215 : Policy authorisation fails for Ranger Plugins in case o…

94831a6

…f users/groups converted by Ranger userysnc as per given Regex

kumaab approved these changes Jul 23, 2025

View reviewed changes

mneethiraj reviewed Jul 23, 2025

View reviewed changes

RANGER-5215 : Policy authorisation fails for Ranger Plugins in case o…

e940ab4

…f users/groups converted by Ranger userysnc as per given Regex

dhavalshah9131 requested a review from mneethiraj July 25, 2025 12:47

mneethiraj reviewed Jul 25, 2025

View reviewed changes

RANGER-5215: updates for code review suggestions

b908f44

RANGER-5215 : Policy authorisation fails for Ranger Plugins in case of users/groups converted by Ranger userysnc as per given Regex #584

Are you sure you want to change the base?

RANGER-5215 : Policy authorisation fails for Ranger Plugins in case of users/groups converted by Ranger userysnc as per given Regex #584

Conversation

dhavalshah9131 commented Jun 5, 2025

What changes were proposed in this pull request?

How was this patch tested?

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rameeshm left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

fateh288 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

fateh288 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dhavalshah9131 Jul 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

dhavalshah9131 Jul 23, 2025 •

edited

Loading