Uploaded image for project: 'Ranger'
  1. Ranger
  2. RANGER-4817

Optimize Ranger HDFS Authorization by combining multiple authorization calls

    XMLWordPrintableJSON

Details

    • Improvement
    • Status: Resolved
    • Major
    • Resolution: Fixed
    • None
    • 3.0.0, 2.5.0
    • Ranger
    • None

    Description

      The focus of optimizations described below is to minimize the number of times the Ranger policy-engine is called to authorize a NameNode RPC without modifying the Namenode authorization interface or authorization call sequence.

      This optimization is possible as the Namenode calls the authorizer more than once to authorize some RPCs, as observed during the testing. To ensure that the authorizer is provided a consistent context to represent a RPC, some improvements are needed in the Namenode. Related Namenode JIRAs are

      HDFS-17478: Avoid creation of AccessControlEnforcer object for every call to the authorizer, and

      HDFS-17500: Provide operation name consistently in the caller-context provided to checkPermissionWithContext() API.

      Ranger authorizer is updated to leverage this context to optimize authorization calls for the RPC. In particular, the following RPC operations' authorization logic is updated.

       

      List of operations with optimized authorization checks.

      1. Create file: operation name “create” 
      2. Rename file: operation name “rename”
      3. Delete file: operation name “delete”
      4. Create directory: operation name “mkdirs”
      5. List directory contents: operation name “listStatus”
      6. Rename directory: operation name “rename”
      7. Delete directory: operation name “delete”
      8. Get Encryption Zone for a directory: operation name “getEZForPath”

      Attachments

        Issue Links

          Activity

            People

              abhayk Abhay Kulkarni
              abhayk Abhay Kulkarni
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: