Presto-Ranger authorization is not working when specific schema is provided in the ranger policy

[bb786112]

When we create ranger policy for presto and provide catalog as "hive" and schema as "aa",
and table and column as "*"
and if we try to connect presto-cli using below command:

./presto-cli --server https://localhost:7272 --keystore-path /etc/presto.jks --keystore-password password --catalog hive --schema aa --user abc --password

The result is access denied for particular schema for a particular user. But if we provide schema as "*" then its work fine and we are able to execute our select statement.

We also looked into logs and found elements below is only using catalog in case of schema provided from ranger UI. and if we provide schema as "*" then element provide all fields as schema, table, columns.

I think its a bug.

2019-07-03T08:11:03.065Z DEBUG Query-20190703_081102_00005_rugns-358 org.apache.ranger.plugin.policyengine.RangerPolicyEngineImpl ==> RangerPolicyEngineImpl.evaluatePolicies(RangerAccessRequestImpl={resource={RangerResourceImpl={ownerUser={null} elements={catalog=hive; } }} accessType={select} user={abc} userGroups={abc } accessTime={null} clientIPAddress={null} forwardedAddresses={} remoteIPAddress={null} clientType={null} action={null} requestData={null} sessionId={null} resourceMatchingScope={SELF} clusterName={null} context={token:USER={abc} } }, policyType=0)

[bb786112]

I think One functionality is missing to check schema access. checkCanSelectFromColumns
method of AccessControlManager checking only catalog using checkCanAccessCatalog method.

Where we should check schema access which is missing in presto.

[zorro1992]

Hey ,
Which Presto version are you using ? Can you please share that . Thank you

In case you have picked some WIP commits while building the jar then let know which are those .

[tooptoop4]

@bb786112 can't reproduce ur issue, policy at specific schema level is allowed for me when querying

[bb786112]

We have tried 315 & 316 version with ranger integration and we can still re-produce this issue.

Steps to Re-produced :

Create a presto (Not Hive) policy for Ranger.
Assign catalog as "" or hive
Assign schema as "dbname" NOT "" --- Star works
Assign table and column as "*"
Assign a user to this policy.

Now try to access presto using same User and access the same schema which is assigned to same user.
It says access denied.

Please let me know your steps I will try to do the same, Hopefully I am missing some steps.

Thanks for your effort

[tooptoop4]

username is case sensitive

[shekarrreddy568-zz]

@bb786112 Hey, We are also facing the same issue, Did you solved it??

[rushidmarne]

@bb786112 @tooptoop4
Can anyone help me setup Ranger Service, I did as below but when I am doing Test Connection, it says "connection failed" ?

[tooptoop4]

@rushidmarne did u solve?

[rushidmarne]

@tooptoop4 : No, It didn't work for me. I tried to create ranger service but unable to do that and found that it was not talking effect in authenticating and authorizing schemas/tables.

[Yulei-Yang]

@rushidmarne ignore this error, that does not matters.

[iammehrabalam]

@bb786112 @shekarrreddy568 I am also facing this issue.
Did u solve this issue?

Presto version: 332
Ranger version: 2.1.0-SNAPSHOT (build from master)

[AvianshKumar]

@

I think One functionality is missing to check schema access. checkCanSelectFromColumns
method of AccessControlManager checking only catalog using checkCanAccessCatalog method.

Where we should check schema access which is missing in presto.

hey I am facing same issues. is this resolve?
Ranger version-2.1.0
PrestoVersion:- 331

[iammehrabalam]

@AvianshKumar
Create two separate policy as follows

1. A policy with access to all catalog, schema, and tables to all users.
2. A policy with access to all functions to all users. (for all users use choose {USER} in the select user input box).

Then create actual policy and add restrictions on catalog, schema, tables, and columns for users.
Hope this will help.

[caofengzhen0207]

@iammehrabalam
how to set policy with access to all functions, i can not find in ranger-ui?thx

Create two separate policy as follows

A policy with access to all catalog, schema, and tables to all users.
A policy with access to all functions to all users. (for all users use choose {USER} in the select user input box).
Then create actual policy and add restrictions on catalog, schema, tables, and columns for users.
Hope this will help.

[iammehrabalam]

@caofengzhen0207

There is already a default policy "all - function". Edit it and add update allow condition for {USER}.
See below screenshot

[anchal-agarwal]

Hi, Any idea if this issue is being looked into?
I tried the workaround suggested by @iammehrabalam and it works but leaves the system vulnerable because of 'allow all users' policy. If any user in not yet part of a deny policy for any reason, then that user ends up getting access to schemas that they should not have access to.

Tried with ranger 2.1.0 and prestosql 347

[byungnam]

Hi. I also met this problem and found a better workaround by making combination of policies. You just need to make every level of policy that gives access to information_schema and the actual schema you want to give permission. The point is that you need to make every level of policies cascading from catalog to column.

Below example shows how to make a hive catalog, default schema access permission.

[You need to make policies to give access to information schema]
Make a catalog:hive policy
Make a catalog:hive + schema:information_schema policy
Make a catalog:hive + schema:information_schema + table:schemata tables policy
Make a catalog:hive + schema:information_schema + table:schemata tables + column:* policy

[Now you make an actual policy]
Make a catalog:hive + schema:default + table:* + column:* policy

Then your policy would look like this:

Slack thread: https://trinodb.slack.com/archives/CGB0QHWSW/p1615531251093100?thread_ts=1609915505.164600&cid=CGB0QHWSW

[findepi]

Trino has no Ranger plugin yet, so let me close this issue as not pertaining Trino